osquery is a cross-platform endpoint agent that exposes operating system state as SQL tables, enabling real-time monitoring, security analytics, and incident response. It runs as a daemon (osqueryd) or interactive shell (osqueryi), with a plugin architecture for configuration, logging, and event collection. The codebase is written in C++ and supports Linux, macOS, and Windows, with hundreds of tables covering processes, network connections, file integrity, hardware, and cloud metadata. The architecture is built around a registry pattern for plugins, an event publisher/subscriber model for real-time telemetry, and a SQLite virtual table layer for query execution. The project is production-grade, with extensive unit and integration tests, fuzzing harnesses, benchmarks, and a CVE scanning workflow. It is actively maintained with regular releases and a large contributor base.