osquery is available through OS package management and standalone installers
For release notes please visit https://github.com/facebook/osquery/releases.
To take advantage of the most current features and join the osquery development community we like to suggest building from source! Head to GitHub clone and compile.
$ git clone http://github.com/facebook/osquery.git $ cd osquery $ make deps $ make -j 8 $ ./build/<platform>/osquery/osqueryi
Install or package
With a working build you may install or create OS-specific packages for deployment. Using the recommended osquery-provided vagrant build environments and the build steps your packages should be as portable as possible.
# make install # optional $ make packages [...] [+] package created at ./build/linux/osquery-XYZ.rpm
OS X Package
You can download a pre-built osquery package that contains the binaries, LaunchDaemon, and example configurations. There are no package or library dependencies needed.
Install with brew
The community publishes an OS X homebrew every other week. Installing using brew is not officially supported since we cannot strictly control the build or library dependency builds.
$ brew update $ brew install osquery $ /usr/local/bin/osqueryi
Install yum repository
We publish osquery in a yum repository for CentOS/RHEL 6.3-6.6 and 7.0 built from our Jenkins build hosts. You may install the "auto-repo-add" RPM or add the repository target:
$ sudo rpm -ivh https://osquery-packages.s3.amazonaws.com/centos7/noarch/osquery-s3-centos7-repo-1-0.0.noarch.rpm $ sudo yum install osquery
$ sudo rpm -ivh https://osquery-packages.s3.amazonaws.com/centos6/noarch/osquery-s3-centos6-repo-1-0.0.noarch.rpm $ sudo yum install osquery
You may also download a pre-built osquery RPM that contains the binaries, an init.d script, and example configurations. There are very few package dependencies needed on CentOS/RHEL 6.6 and 7.0.
Install apt repository
We publish osquery in an apt repository for Ubuntu 12.04 (precise), 14.04 (trusty), and 16.04 (xenial):
Ubuntu 16.04 LTS Xenial
$ sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 1484120AC4E9F8A1A577AEEE97A80C63C9D8B80B $ sudo add-apt-repository "deb [arch=amd64] https://osquery-packages.s3.amazonaws.com/xenial xenial main" $ sudo apt-get update $ sudo apt-get install osquery
Ubuntu 14.04 and 12.04 LTS
$ sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 1484120AC4E9F8A1A577AEEE97A80C63C9D8B80B $ sudo add-apt-repository "deb [arch=amd64] https://osquery-packages.s3.amazonaws.com/trusty trusty main" $ sudo apt-get update $ sudo apt-get install osquery
You may also download a pre-built osquery DPKG DEBs that contain the binaries, an init.d script, and example configurations.
Ubuntu 16.04 LTS Xenial
Ubuntu 14.04 & 12.04 LTS
Windows Choco Package
We recommend installing and deploying Windows support using chocolatey. Please let us know if your enterprise could make use of other package formats.
C:\> choco install osquery
For details see the chocolatey project page https://chocolatey.org/packages/osquery.
Version 2.0.0 is the first with Windows support. As we develop table parity with POSIX, we also recommend following along and contributing to the development effort!
C:\> git clone https://github.com/facebook/osquery C:\> .\tools\make-win64-dev-env.bat C:\> .\tools\make-win64-binaries.bat
Links for scripts
Every release version is published to S3 on midnight of the release day. A symlink is created for external projects, package maintainers, and integrations. You can find the latest stable package in each platform and distribution's directory on S3:
https://osquery-packages.s3.amazonaws.com/darwin/osquery.pkg https://osquery-packages.s3.amazonaws.com/centos7/osquery.rpm https://osquery-packages.s3.amazonaws.com/centos6/osquery.rpm https://osquery-packages.s3.amazonaws.com/precise/osquery.deb https://osquery-packages.s3.amazonaws.com/trusty/osquery.deb https://osquery-packages.s3.amazonaws.com/xenial/osquery.deb