Ben Chuanlong Du's Blog

It is never too late to learn.

Query and Monitor OS Information using osquery

Things on this page are fragmentary and immature notes/thoughts of the author. Please read with your own judgement!

  1. List all tables.

    .\osqueryi .tables

  2. Check the schema of a table (e.g., "process").

    .\osqueryi ".schema processes"

Querying System Information

.\osqueryi.exe "select * from system_info"

Querying Docker

Please refer to Manage …