Skip to main content
Warning
This app is archived. App archiving documentation
add-on for osquery app icon

add-on for osquery

Provides a data input and CIM-compliant field extractions for osquery (https://github.com/facebook/osquery). "Osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Available for Linux, macOS, Windows and FreeBSD."Built by Jose Hernandez
splunk product badge
Default Version 1.0.0

March 1, 2019

Compatibility

Splunk Enterprise

Platform Version: 9.4, 9.3, 9.2, 9.1, 9.0

CIM Version: 4.x

Rating
0
(0)

Log in to rate this app

Support
Archived Add-on

Provides a data input and CIM-compliant field extractions for osquery (https://github.com/facebook/osquery). "Osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Available for Linux, macOS, Windows and FreeBSD." For the latest version of this TA, see: https://github.com/splunk/TA-osquery