Implementing osquery for endpoint monitoring
Skill autohandai/community-skills/implementing-osquery-for-endpoint-monitoring
A collection of curated, useful, and safe skills for Autohand Code CLI Agent
npx -y skills add autohandai/community-skills --skill implementing-osquery-for-endpoint-monitoringAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 9 stars9 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Deploy osquery scheduled queries for continuous endpoint monitoring covering process inventory, network connections, file integrity, and persistence mechanisms. Generates osquery.conf with query packs, configures differential result logging, and analyzes query results to detect suspicious processes, unauthorized listeners, and file modifications in system directories.
The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
1.4 KB, as published. Nobody here has run it
Instructions
- Install dependencies:
pip install requests(osquery installed on endpoints) - Generate
osquery.confwith scheduled query packs for:- Process monitoring: new processes, unusual parent-child relationships
- Network listeners: unexpected listening ports and outbound connections
- File integrity: modifications in /etc, /usr/bin, system32
- Persistence: cron jobs, startup items, scheduled tasks, services
- Deploy configuration to endpoints.
- Analyze differential results from osquery log output.
- Generate security findings report.
python scripts/agent.py --results-dir /var/log/osquery/results/ --output osquery_report.json
Examples
Osquery Scheduled Query
{"schedule": {"process_snapshot": {"query": "SELECT pid, name, path, cmdline, uid FROM processes WHERE on_disk = 0;", "interval": 300}}}