Facebook's osquery Now Available for Windows

Facebook's insanely popular osquery project is now available for Windows after it was launched in 2014 with support for only Mac OS X, Ubuntu, and CentOS.

If you're not familiar with the project, osquery is a tool loved by sysadmins, network admins, and security engineers alike.

osquery allows developers to query the underlying operating system using an easy-to-read and easy-to-learn SQL-like language. osquery code looks something like this:

[CODE=osquery]SELECT uid, name FROM listening_ports l, processes p WHERE l.pid=p.pid;

SELECT * FROM kernel_extensions WHERE name NOT LIKE 'com.apple.%' AND name != '__kernel__';

SELECT name, path, bundle_version, applescript_enabled FROM apps ;

SELECT uid, name FROM listening_ports l, processes p WHERE l.pid=p.pid; [/CODE]

There's a tangible benefit from working with osquery, rather than working with low-level C APIs.

osquery organizes OS data as SQL-like tables

osquery, ...