osquery

What it is and what it does

osquery-python is the official Python API for osquery, which exposes an operating system as a queryable relational database. It provides two main capabilities: creating custom osquery extensions by implementing table plugins in Python, and executing SQL queries against osquery instances (either spawned ephemeral processes or existing osqueryd daemons) via Thrift bindings.

The package depends on thrift for RPC communication, future for Python 2/3 compatibility, and pywin32 for Windows support. It is designed for system administrators and security engineers who want to extend osquery's functionality or integrate osquery queries into Python applications. The dormant maintenance status (751 days since last release) means the package is stable but receives no active development.

Use it for:

• Build custom osquery table plugins in Python to expose internal APIs or proprietary data as queryable tables.
• Execute SQL queries against a running osqueryd daemon from a Python application to gather system state or security telemetry.
• Spawn ephemeral osquery instances from Python for one-off or batch system queries without managing a separate osquery process.
• Integrate osquery into Python-based security monitoring or incident response workflows via the Thrift client API.
• Extend osquery with Python logic for specialized hardware events, file hashing, or custom system introspection.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Python bindings for creating osquery extensions and querying osquery instances via SQL, allowing you to extend osquery with custom tables or execute queries against running osquery processes.

Yes, if you are already using osquery and need Python bindings to extend it or query it programmatically. The low install friction and permissive license are favorable. However, be aware that maintenance is dormant—no active development or bug fixes are expected—and the classifiers only list Python up to 3.6, so compatibility with newer Python versions is unverified. Use it for stable, established osquery deployments, not for new projects expecting ongoing support.

Install

osquery on PyPI

pip install osquery

uv add osquery

poetry add osquery

Installing osquery

Before you install

Low install friction with a pure-Python wheel distribution. Maintenance is dormant—last release was 751 days ago—so expect no active bug fixes or feature development, though the package is marked Production/Stable.

License in practice

BSD permissive license means you can use, modify, and distribute this package with minimal restrictions, provided you retain the license notice.

Quickstart

pip install osquery

import osquery

instance = osquery.SpawnInstance()
instance.open()
result = instance.client.query("select timestamp from time")

Verify before relying

• Whether pywin32 is required on non-Windows platforms or is a conditional dependency
• Current compatibility with Python versions newer than 3.6 (classifiers list only up to 3.6)
• Whether the package works with modern osquery versions released after the last Python binding update

Package facts

Evidence: osquery-3.1.1-py2.py3-none-any.whl

Keywords: security, databases, operating, systems

Tags

More Security packages