danicat/aida/pack-osquery-monitoring

Osquery Daemon Health & Telemetry Query Pack

The pack-osquery-monitoring skill equips agents with curated queries and diagnostic procedures from osquery_data/packs/osquery-monitoring.conf. This query pack focuses on osquery daemon health & telemetry query pack.

Threat Model & Scope

Ensuring the integrity and stability of the osquery telemetry pipeline itself is paramount. This pack guards against:

• Runaway or unoptimized queries consuming excessive CPU or resident memory.
• Event buffer overflows where kernel or filesystem events are dropped before ingestion.
• Daemon crashes or watchdog restarts indicated by short uptime durations.

Triage & Investigation Runbook

Daemon Health Diagnostic Workflow

1. Check Daemon Status: Execute SELECT * FROM osquery_info; to verify version and uptime.
2. Analyze Query Latency: Run SELECT name, executions, wall_time, average_memory FROM osquery_schedule ORDER BY wall_time DESC LIMIT 5;.
3. Inspect Event Publisher Drops: Run SELECT name, publisher, events, drops FROM osquery_events WHERE drops > 0;. If drops are high, tune buffer sizes or event filters.

Complete Query Catalog

1. schedule

• Description: Report performance for every query within packs and the general schedule.
• Interval: 7200 seconds
• Minimum Osquery Version: 2.11.0
• SQL Query:

select name, interval, executions, output_size, wall_time, (user_time/executions) as avg_user_time, (system_time/executions) as avg_system_time, average_memory, last_executed, denylisted from osquery_schedule;

2. events

• Description: Report event publisher health and track event counters.
• Interval: 86400 seconds
• Minimum Osquery Version: 1.5.3
• SQL Query:

select name, publisher, type, subscriptions, events, active from osquery_events;

3. osquery_info

• Description: A heartbeat counter that reports general performance (CPU, memory) and version.
• Interval: 600 seconds
• Minimum Osquery Version: 1.2.2
• SQL Query:

select i.*, p.resident_size, p.user_time, p.system_time, time.minutes as counter from osquery_info i, processes p, time where p.pid = i.pid;

Referenced Table Schemas

osquery_events

Information about the event publishers and subscribers.

osquery_info

Top level information about the running version of osquery.

osquery_schedule

Information about the current queries that are scheduled in osquery.