Osquery

Platform

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

October 24, 2025

Last Seen

September 8, 2026

API

Osquery is an open-source endpoint visibility platform that exposes operating system information through a SQL-like interface, enabling scalable, real-time inventory, compliance checks, and threat hunting across Windows, macOS, and Linux endpoints.

Overview

Recent Events

Relationships

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Related Clusters (3)

Related Entities

Azure AWS Cobalt Strike Empire Hydra Loki Mythic RedLine Sliver T1003 - OS Credential Dumping T1021.006 - Windows Remote Management T1021 - Remote Services

Osquery

Overview

Recent Events

Profile

Malware

Threat Actors

Tools

Relationships

Related Clusters (3)

Storm-0501 Cybercrime Group Targets Azure with Ransomware Tactics

Emergence of PentestingEverything and Outis Remote Management Tool

Security Onion Releases Version 2.4.200 with Enhanced Onion AI Assistant

Related Articles (3)

PentestingEverything exploit

Security Onion 2.4.200 now available with Major Improvements for our Onion AI Assistant!

Security Onion 2.4.190 now available including Onion AI Assistant for Pro Customers!

Related Entities