50 Osquery Query Examples Every Security Team Should Run

The problem with most osquery query examples is not the SQL. It is that nobody says what to do with the rows.

A list of 50 queries can create 50 new feeds of noise. The useful version attaches a question, platform scope, cadence, baseline, and owner to every statement. Run these examples first in osqueryi, then promote only the queries that change a real decision.

That discipline matters more in 2026. Verizon reported that vulnerability exploitation became the leading breach entry point at 31 percent in its 2026 DBIR public sector analysis. Only 26 percent of critical KEV vulnerabilities were fully remediated in 2025, and median resolution reached 43 days. Better endpoint questions should shorten that delay, not add another dashboard.

Which osquery query examples should every team run?

Start with fleet truth, software, persistence, configuration, and investigation pivots. Each query below uses the osquery SQLite dialect and current table names. Platform support still varies. The official osquery SQL guide says some tables require a path or another constraint. Keep those inputs narrow, and verify every statement against the schema shipped with your agent.

How do you turn examples into a production pack?

Do not schedule all 50. Choose one decision for one cohort. Add an explicit column list, platform selector, minimum version, interval, and description. Decide whether you need differential results or full snapshots. Differential mode records added and removed rows. Snapshot mode sends the full answer each time.

The official schedule specification sets snapshot to false and removed row logging to true by default. It permits intervals up to 604,800 seconds and deterministic sharding from 1 to 100 percent. Those controls are your rollout mechanism. Start at one percent, measure, then expand.

Simple math is unforgiving. Fifty hourly queries across 5,000 endpoints create six million executions a day. Even when each query takes only 40 milliseconds, that is 66.7 hours of combined endpoint compute every day, before result storage and analyst review. Ten focused queries at the right cadence beat a giant pack nobody owns.

Schema versions move too. Osquery 5.23.0, released April 25, 2026, added Windows process handle visibility, Linux Secure Boot certificates, process memory YARA scanning, and broader modern package manager coverage. The official 5.23.0 release notes are a reminder that a pack must declare its minimum agent version and test result shape during upgrades.

How should query results be triaged?

Compare results with approved state before opening work. An unknown service is not automatically malicious. A process missing from disk can be a normal upgrade. An open port may belong to an approved developer tool. Add asset role, owner, exposure, change record, and recent activity before assigning severity.

This is where deep endpoint context with AI driven analysis helps Artemes AI separate a real finding from a version or configuration match. A rules based program should demand the same evidence. Every ticket should say what changed, why it matters on this host, who owns it, and how to verify the fix.

For investigation queries, preserve the raw result and collection time. For compliance queries, preserve the expected value, exception, approver, and expiry. For vulnerability queries, preserve package source, version, reachability evidence, and remediation command. One row can support different decisions, but the evidence packet cannot be vague.

Frequently asked questions

Can I paste these queries directly into osqueryi?

Yes, after checking that the table exists on your platform. Event table examples also require collection to be enabled and configured before they return data.

Why do some osquery queries return no rows?

No rows can be a valid answer, an unsupported table, missing permissions, an unmet required constraint, or a collection failure. Check .schema, status logs, and the agent version.

Should every query run on a schedule?

Keep expensive or sensitive pivots for live investigations. Schedule only the evidence whose freshness changes an ongoing decision.

How often should security queries run?

Match the interval to the shortest useful response window. Process events may need minutes. Installed software may need hours. Hardware inventory may need a day. Measure cost on each host cohort.

The takeaway

Pick ten examples, test them on one host per operating system, and write the action beside each result. Remove any query that has no owner. Canary the remaining pack at one percent, measure cost and row volume for a week, then expand. The goal is not 50 scheduled statements. It is a smaller set of questions that consistently ends in owned action.

Continue with the definitive osquery handbook, the SQL writing guide, and the query pack deployment guide. The older threat hunting guide shows how to turn a query into a comparison with a hypothesis.