Skip to content
Get packs

Guide · Agent skill

How to use the Osquery Endpoint Monitoring agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This guide explains how to install and use the deploying-osquery-for-endpoint-monitoring agent skill, which lets an AI agent walk you through deploying osquery on Windows, macOS and Linux. It is written for people who have never used agent skills and for security engineers or sysadmins who want endpoint visibility through SQL. By the end you will know how to add the skill, ask for help with natural requests, and understand what osquery needs and where its limits are.

Osquery Endpoint Monitoringmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Download and add the skill. Download the skill ZIP from this page. Unzip it into ~/.claude/skills/, into a project's .claude/skills/ folder, or upload it under Settings, Capabilities, Skills in the Claude apps.
  2. 2Install osquery on a test machine. Install the osquery package for your OS using admin or root rights. On macOS, brew install osquery is shown in the skill. Make sure osqueryi is available.
  3. 3Review the sample configuration. Open the sample osquery.conf and check the schedule intervals, log path and packs against your environment.
  4. 4Run a threat hunting query. Start with a narrow query such as listing processes with no on-disk binary, and review the results before changing anything.
  5. 5Ask the agent to adapt the setup. Describe your OS, fleet size and goal in a plain request so the agent can tailor queries and deployment steps.
  6. 6Pilot before production. Deploy to a small group, verify enrollment and scheduled queries, and watch for CPU impact before wider rollout.

What the skill makes the agent do

Osquery is a free agent that exposes a computer's state, such as running processes, open ports, installed software, users, scheduled tasks and startup items, as SQL tables you can query. Once this skill is loaded, the agent can guide you through deploying osquery and configuring it for periodic monitoring.

The skill provides a sample configuration with scheduled queries, ready-made threat hunting SQL, and notes on managing a fleet of machines with FleetDM or Kolide. It also includes two Python helpers: scripts/agent.py runs osquery queries locally, and scripts/process.py parses osquery JSON logs to flag items that were added or removed.

Install the agent skill

Download the skill ZIP from the skill's page on this site. You can install it in one of two ways.

For a personal setup, unzip the download into ~/.claude/skills/. To scope it to a single project, unzip it into that project's .claude/skills/ folder. Alternatively, in the Claude apps, open Settings, go to Capabilities, then Skills, and upload the ZIP there.

  • Personal: unzip into ~/.claude/skills/
  • Project only: unzip into .claude/skills/ inside your project
  • Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Install osquery on the endpoints you want to monitor

Osquery must be installed on each target machine, and installation requires admin or root privileges. The skill's examples cover Ubuntu/Debian, Windows and macOS. Osquery packages for every OS are listed on osquery.io/downloads. For Windows, the source points to the official MSI on osquery.io/downloads/official.

The skill's Ubuntu/Debian and macOS commands are shown below. Osqueryi must be present, because scripts/agent.py depends on it.

brew install osquery apt-get update && apt-get install osquery -y

Configure osquery with scheduled queries

The skill's sample config lives at /etc/osquery/osquery.conf on Linux and macOS, or C:\ProgramData\osquery\osquery.conf on Windows. It sets options such as the filesystem config and logger plugins, the logger path /var/log/osquery, and schedule splay. The schedule section holds named queries with intervals in seconds. Examples include process_monitor (processes with no on-disk binary, every 300 seconds), listening_ports (every 600 seconds), persistence_check using startup_items (every 3600 seconds), installed_packages using deb_packages (every 86400 seconds), and suid_binaries (every 86400 seconds).

The sample config also references three packs: incident-response, ossec-rootkit and vuln-management. Treat the sample as a starting point. Query intervals and paths need tuning for your environment before production use.

  • Use intervals of 300 to 3600 seconds for most queries, as the skill recommends
  • Test query cost with EXPLAIN before scheduling heavy queries
  • Enable differential logging so only changes are recorded, which reduces data volume

Run threat hunting queries

The skill includes starter SQL for common hunts. You can run these in osqueryi on a machine, or ask the agent to adapt them for your case. Each query targets a specific question about endpoint state.

The queries cover processes with no on-disk binary (a possible sign of fileless malware), listening ports outside a known list, unexpected SSH authorized keys, recently modified files in /usr/bin, processes connecting to external IP addresses, and, on Windows, running executables that are not trusted by their signature.

SELECT pid, name, path, cmdline FROM processes WHERE on_disk = 0; SELECT * FROM authorized_keys WHERE NOT key LIKE '%admin-team%';

Manage a fleet with FleetDM or Kolide

For more than a handful of machines, the skill points to FleetDM or Kolide Fleet for centralized management. Agents enroll with a server over TLS and receive their configuration from it. The skill's notes show example agent flags for a Fleet server, including tls_hostname, tls_server_certs and enroll_secret_path.

Fleet deployments also need TLS certificates, and enterprise setups commonly use a log pipeline such as Filebeat or Fluentd to collect osquery result logs. The skill's workflows suggest deploying to a pilot group first, verifying enrollment and scheduled queries, then rolling out to production.

Ask the agent for help in plain language

You do not need to remember file names or commands. Describe the goal and the agent should use this skill. The skill is meant for requests about osquery deployment, endpoint visibility, fleet management, SQL-based endpoint querying, threat hunting across a fleet, and compliance monitoring.

Use a request that names osquery or endpoint monitoring, and say which operating system and goal you have. Requests that ask for real-time alerting or blocking are outside this skill's scope.

  • Help me deploy osquery to our Ubuntu servers and schedule a daily software inventory
  • Write osquery SQL to find processes connecting to external IP addresses
  • Set up a pilot osquery rollout with FleetDM and a verification checklist
  • Give me a template to record our osquery schedule and sign-off

Safety notes: scripts and network use

This skill runs scripts and uses the network. The scripts are scripts/agent.py and scripts/process.py. Read them before running them, especially on production machines. Installation and configuration need admin or root rights, so only run them on machines you are authorized to administer.

Osquery sends results to a logger path or to a Fleet server, and enterprise setups use TLS. Heavy queries can cause CPU spikes on endpoints, so test them on a pilot group first.

  • Review scripts/agent.py and scripts/process.py before running them
  • Confirm you have admin or root rights on each endpoint
  • Test sample configs and queries on a small group before production

What people use it for

  • Building a daily software inventory across Linux servers using a scheduled deb_packages query
  • Hunting for processes that run without an on-disk binary as a possible fileless malware sign
  • Reviewing SSH authorized_keys across machines against a list of approved keys
  • Monitoring startup items and cron jobs as a persistence check
  • Drafting an osquery rollout plan with FleetDM for a pilot group

Frequently asked questions

Is osquery free to use?

The source describes osquery as a free agent and FleetDM as an open-source fleet management platform. The skill itself is licensed under Apache-2.0. Check each project's current terms before use, since the source does not cover licensing details beyond these notes.

What do I need to run this skill?

You need the osquery package on target endpoints, with osqueryi available because scripts/agent.py uses it. You also need Python 3 to run the scripts and admin or root privileges on endpoints for installation. Fleet servers, TLS certificates and a log pipeline such as Filebeat or Fluentd are optional for enterprise use.

Can osquery do real-time alerting or block threats?

No. The skill says osquery is periodic or on-demand, so it is not meant for real-time alerting. For real-time detection or blocking, use an EDR product alongside or instead of osquery.

What is the difference between FleetDM and Kolide?

The source describes FleetDM as an open-source osquery fleet management platform and Kolide as cloud-based osquery management with Slack integration. Both are covered in the skill for centralized management. The source does not compare them on features or cost, so check each vendor's documentation.

Why are my osquery queries slowing down my machines?

Complex queries with large table scans and very short intervals can cause CPU spikes. The skill recommends intervals of 300 to 3600 seconds for most queries and using WHERE clauses. Test query cost with EXPLAIN before scheduling.

Why do some osquery tables return no data?

Some tables, such as process_events and socket_events, require the events framework. The skill says to enable it with --disable_events=false. Check the table list in the skill's API reference if a table stays empty.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits security engineers, sysadmins and threat hunters who want guided osquery setup, starter SQL and fleet notes across Windows, macOS and Linux. It is not a substitute for EDR, and it is not suited to people without admin rights on the machines they monitor. Review the sample configs and scripts before running them on production systems.

Download the skill