I have always wanted to use osquery and checkout the capabliity so what I can understand how it can help me identifyting aversaries in my environment. But to do that, first I needed to understand how it all works. In the post, I will be installing osquery and checking out its power and how it can assist me in protecting my environment.

Follow the steps below to perform the installation of osqueryi in virtual machine with following:

$ cat /etc/lsb-release 
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=22.04
DISTRIB_CODENAME=jammy
DISTRIB_DESCRIPTION="Ubuntu 22.04.2 LTS"
$ uname -a
Linux osquery1 6.2.0-26-generic #26~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Jul 13 16:27:29 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

Install some packages

sudo apt install curl

We need to add the repository in order to install osquery.

curl -fsSL  https://pkg.osquery.io/deb/pubkey.gpg | sudo gpg --dearmor -o /etc/apt/keyrings/osquery.gpg
echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/osquery.gpg] https://pkg.osquery.io/deb deb main" | sudo tee /etc/apt/sources.list.d/osquery.list > /dev/null
sudo apt update
sudo apt install osquery

==> OUTPUT
Hit:1 http://gb.archive.ubuntu.com/ubuntu jammy InRelease
Hit:2 http://security.ubuntu.com/ubuntu jammy-security InRelease
Hit:3 http://gb.archive.ubuntu.com/ubuntu jammy-updates InRelease
Hit:4 http://gb.archive.ubuntu.com/ubuntu jammy-backports InRelease  
Get:5 https://osquery-packages.s3.us-east-1.amazonaws.com/deb deb InRelease [69.9 kB]
Get:6 https://osquery-packages.s3.us-east-1.amazonaws.com/deb deb/main amd64 Packages [20.7 kB]
Fetched 90.6 kB in 1s (84.0 kB/s)
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
327 packages can be upgraded. Run 'apt list --upgradable' to see them.
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following NEW packages will be installed:
  osquery
0 upgraded, 1 newly installed, 0 to remove and 327 not upgraded.
Need to get 30.0 MB of archives.
After this operation, 86.0 MB of additional disk space will be used.
Get:1 https://osquery-packages.s3.us-east-1.amazonaws.com/deb deb/main amd64 osquery amd64 5.9.1-1.linux [30.0 MB]
Fetched 30.0 MB in 9s (3,382 kB/s)                                                                                                           
Selecting previously unselected package osquery.
(Reading database ... 203957 files and directories currently installed.)
Preparing to unpack .../osquery_5.9.1-1.linux_amd64.deb ...
Unpacking osquery (5.9.1-1.linux) ...
Setting up osquery (5.9.1-1.linux) ...
1464

osquery now should be installed and we can now run it now.

$ osqueryi 
Using a virtual database. Need help, type '.help'
osquery> .help
Welcome to the osquery shell. Please explore your OS!
You are connected to a transient 'in-memory' virtual database.

.all [TABLE]     Select all from a table
.bail ON|OFF     Stop after hitting an error
.connect PATH    Connect to an osquery extension socket
.disconnect      Disconnect from a connected extension socket
.echo ON|OFF     Turn command echo on or off
.exit            Exit this program
.features        List osquery's features and their statuses
.headers ON|OFF  Turn display of headers on or off
.help            Show this message
.mode MODE       Set output mode where MODE is one of:
                   csv      Comma-separated values
                   column   Left-aligned columns see .width
                   line     One value per line
                   list     Values delimited by .separator string
                   pretty   Pretty printed SQL results (default)
.nullvalue STR   Use STRING in place of NULL values
.print STR...    Print literal STRING
.quit            Exit this program
.schema [TABLE]  Show the CREATE statements
.separator STR   Change separator used by output mode
.socket          Show the local osquery extensions socket path
.show            Show the current values for various settings
.summary         Alias for the show meta command
.tables [TABLE]  List names of tables
.types [SQL]     Show result of getQueryColumns for the given query
.width [NUM1]+   Set column widths for "column" mode
.timer ON|OFF      Turn the CPU timer measurement on or off