forensics-osquery

What problem does it solve?

Osquery-based investigations enable security teams to quickly collect and analyze endpoint evidence using SQL queries, reducing time-to-insight during incidents.

Core Features & Use Cases

• SQL-based interrogation of processes, network connections, files, registry and persistence artifacts across Linux, macOS, and Windows.
• Prebuilt triage and threat-hunting workflows with guided playbooks and MITRE ATT&CK mappings.
• Use cases include rapid incident response, threat hunting, and post-incident forensic timeline construction.

Quick Start

Run the bundled triage script to collect forensic artifacts from the target endpoint and then execute the hunting workflow to map findings to MITRE techniques.