Skip to content
Get packs

Osquery Endpoint Monitoring

Set up osquery and write SQL queries to inspect processes, ports, software and config on endpoints.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
7 files

What it does

Once installed, the agent can guide you through deploying osquery, a free agent that exposes a computer's state (running processes, open ports, installed software, users, scheduled tasks, startup items) as SQL tables you can query. It supplies a sample config with scheduled queries, ready-made threat hunting SQL, and notes on fleet management with FleetDM or Kolide. It also includes two Python helpers: one runs osquery queries locally, the other parses osquery JSON logs to flag added or removed items.

Great for

  • Security engineers or sysadmins building endpoint visibility across Windows, macOS and Linux
  • Threat hunters who want starter SQL queries for suspicious processes, ports or SSH keys
  • Teams planning compliance monitoring of installed software and system configuration
  • Students learning how osquery and endpoint telemetry work

Skip it if

  • Real-time alerting or blocking: the skill itself says osquery is periodic or on-demand, so use an EDR product for that
  • Production rollout without review: sample configs and queries need tuning for your environment, and heavy queries can cause CPU spikes
  • Non-technical users with no admin access to the machines being monitored, since installation requires elevated privileges

Try asking

  • “Write an osquery config that checks for processes running without an on-disk binary every 5 minutes”
  • “Give me SQL to find listening ports not associated with known services on our Linux servers”
  • “Help me deploy osquery to Windows endpoints and enroll them in FleetDM”
  • “Analyze this osquery JSON result log and list the added items per host”
Step-by-step guide: how to use Osquery Endpoint MonitoringInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.

    deploying-osquery-for-endpoint-monitoring.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip deploying-osquery-for-endpoint-monitoring.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip deploying-osquery-for-endpoint-monitoring.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Review every query and config before deploying; the sample SQL includes a hardcoded port allowlist and 10.x/172.16.x/192.168.x private-range checks that must match your network
  • Test scripts/agent.py on a non-production machine first, since it executes osqueryi with subprocess and the agent runs commands on the host
  • Start with longer intervals (300-3600 seconds) and use differential logging to limit load and log volume

What's inside

  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.