osquery Developer Kit Launched For Windows

Facebook announced the availability of an osquery developer kit for Windows. Security teams will now be able to build customized osquery solutions for their Windows networks.
In 2014, Facebook had open-sourced osquery, an SQL-powered detection tool for Linux and OS X, which would provide real-time insight into the state of corporate infrastructure. osquery allows users to write SQL-based queries which go on to explore operating system data. With the osquery, SQL tables represent abstract concepts, like running process, loaded kernel modules, open network connections, browser plugins, and hardware events or file hashes.
Image Source: facebook.com
The company states,
“Having timely, reliable visibility into operations running throughout your network is critical to quickly identify and investigate anomalies.”
The following example has been provided by Facebook, where the company states,
“osquery allows our Facebook security team to fetch data about all browser extensions running on our corporate network. We then compare that information to threat intelligence data to quickly identify malicious extensions and remove them. This proactive technique, known as “threat hunting,” is an important enhancement to traditional detection-based security, but not yet offered by many commercial agents.”
‘As adoption for osquery grew, a strong and active community emerged in support of a more open approach to security.’ The initial release of osquery was supported for Linux and OS X, however the community was really excited for a Windows version, and Facebook had gone on to build it.
The osquery developer kit for Windows includes documentation, the development environment and a single script for you to start with. Once you have gone on to install the build, you can immediately start coding.
The company said,
“This port of osquery to Windows gives you the ability to unify endpoint defense and participate in an active open source community ready to share experiences and stories.”