Osquery is a technology platform tracked across 1 threat cluster and 2 intelligence report mentions on ThreatCluster. First observed October 24, 2025; most recent activity December 16, 2025.
Osquery is an open-source endpoint visibility platform that exposes operating system information through a SQL-like interface, enabling scalable, real-time inventory, compliance checks, and threat hunting across Windows, macOS, and Linux endpoints. It supports data collection for detection, investigations, and security operations and integrates with SIEMs and EDR tools for rapid insights. The two provided articles focus on Security Onion's Onion AI Assistant releases and do not explicitly mention Osquery.
Security Onion has released version 2.4.200, which includes significant improvements to the Onion AI Assistant for Pro customers. The update enhances the AI's accuracy and introduces new tools for alert triaging and…