Welcome to the documentation for osquery — the SQL-powered system telemetry engine maintained by Flamingo as part of the OpenFrame platform.
osquery exposes operating system state as a relational database, enabling operators to query processes, users, files, network sockets, hardware, and real-time events using standard SQL.
New to osquery? Start here.
| Guide | Description |
|---|---|
| Introduction | What osquery is, key features, architecture overview, and target audience |
| Prerequisites | Hardware requirements, supported OS, required software, and verification steps |
| Quick Start | Clone, build, and run osquery in minutes |
| First Steps | Explore tables, write security queries, configure scheduled queries, and enable FIM |
Guides for contributors and developers working on the osquery codebase.
| Guide | Description |
|---|---|
| Local Development | Cloning, building, running, debugging, and working with the Extension SDK |
| Environment Setup | IDE configuration, compiler setup, clang-format, and development tooling |
| Guide | Description |
|---|---|
| Architecture Overview | High-level design, core components, process model, SQL lifecycle, eventing, and key design decisions |
| Guide | Description |
|---|---|
| Testing Overview | Test structure, building and running tests, writing unit/integration tests, benchmarks, and CI |
| Guide | Description |
|---|---|
| Security Guidelines | Authentication, encryption, SQL authorizer, secrets management, and common vulnerability mitigations |
| Guide | Description |
|---|---|
| Contributing Guidelines | Code style, branch naming, commit format, PR process, and review checklist |
Detailed technical documentation for each osquery subsystem, generated from source code analysis.
| Module | Description |
|---|---|
| SQL Core & Virtual Tables | SQLite embedding, virtual table framework, diff engine, and query lifecycle |
| Eventing Core | Publisher–subscriber OS event framework, EventFactory, subscriptions, and PathSet |
| Core Init, Shutdown & Watcher | Process lifecycle, watcher/worker model, watchdog resource enforcement |
| Core Config & Flags | Configuration loading, schedules, packs, flag management, and dynamic reconfiguration |
| Database | Pluggable key-value persistence, RocksDB backend, ephemeral fallback, and schema migrations |
| Logging | Pluggable logger plugins, StatusLogLine, FilesystemLoggerPlugin, and logging modes |
| Distributed Querying | Remote SQL orchestration over TLS, denylisting, performance tracking, and result buffering |
| Extensions & IPC | Thrift-based RPC, extension lifecycle, registry broadcasting, and health monitoring |
| Filesystem & Fileops | Cross-platform file abstraction, permission enforcement, globbing, and read limits |
| Hashing | Streaming SHA-256, SHA-1, MD5; single-pass multi-hash; file and buffer hashing |
| Remote HTTP | Boost.Beast HTTPS client, TLS handling, proxy support, and timeout management |
Visual Mermaid diagrams for each subsystem are located in:
docs/diagrams/architecture/
Diagrams are available for all major modules including SQL Core, Eventing Core, Distributed Querying, Extensions, Database, Logging, and more.
| Resource | Link |
|---|---|
| Project README | ../README.md |
| Contributing Guide | ../CONTRIBUTING.md |
| Source Repository | https://github.com/flamingo-stack/osquery |
| OpenMSP Slack | https://www.openmsp.ai/ |
| Flamingo | https://flamingo.run |
| OpenFrame Platform | https://openframe.ai |
All collaboration, questions, and discussions happen on the OpenMSP Slack community:
- 💬 Join: https://join.slack.com/t/openmsp/shared_invite/zt-36bl7mx0h-3~U2nFH6nqHqoTPXMaHEHA
- 🌐 OpenMSP: https://www.openmsp.ai/
We do not use GitHub Issues or GitHub Discussions. All support and development discussions take place on Slack.
Documentation generated by 🦩 Flamingo AI Technical Writer