Mac malware analysis using osquery

Osquery, at its most basic level, is an operating system instrumentation framework that exposes the OS as a SQL database. SQL queries can be run to view information about the systems similar to any SQL database, providing a unified cross platform framework (i.e. endpoints running on multiple operating systems can be queried using the industry standard database language: SQL).

This structured approach for collecting and accessing data introduces great flexibility, making it useful for multiple purposes. For example, …

analysis basic can cross platform database endpoints framework industry information instrumentation mac mac malware malware malware analysis operating system operating systems osquery platform run running sql sql database system systems