Facebook

Today, we're excited to announce the availability of an osquery developer kit for Windows! Security teams can now build customized osquery solutions for their Windows networks.

In 2014, Facebook open sourced osquery, an SQL-powered detection tool for Linux and OS X that provides real-time insight into the state of corporate infrastructure. osquery allows you to write SQL-based queries that explore operating system data. With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events or file hashes. Having timely, reliable visibility into operations running throughout your network is critical to quickly identify and investigate anomalies.

For example, osquery allows our Facebook security team to fetch data about all browser extensions running on our corporate network. We then compare that information to threat intelligence data to quickly identify malicious extensions and remove them. This proactive technique, known as “threat hunting,” is an important enhancement to traditional detection-based security, but not yet offered by many commercial agents.

As adoption for osquery grew, a strong and active community emerged in support of a more open approach to security. We saw the long-held misconception of “security by obscurity” fall away as people started sharing tooling and experiences with other members of the community. Our initial release of osquery was supported for Linux and OS X, but the community was also excited for a Windows version — so we set out to build it.

We enlisted the help of engineers at Trail of Bits to accelerate and document the entire public development process, so you can easily jump into the project with a clear audit trail. You can read the full documentation of the development process from Trail of Bits here.

Getting Started
The osquery developer kit for Windows includes documentation, the development environment, and a single script to get you started. Once you install the build, you can start coding right away.

This port of osquery to Windows gives you the ability to unify endpoint defense and participate in an active open source community ready to share experiences and stories. Join the growing #windows channel on our Slack!