---
id: osquery
version: "3.1.1"
license: BSD
license_treatment: permissive
maintenance: dormant
---

# osquery — Osquery Python API

License: permissive · Maintenance: dormant · Downloads: 231.9K/mo

## What it is and what it does

osquery-python is the official Python API for osquery, which exposes an operating system as a queryable relational database. It provides two main capabilities: creating custom osquery extensions by implementing table plugins in Python, and executing SQL queries against osquery instances (either spawned ephemeral processes or existing osqueryd daemons) via Thrift bindings.

The package depends on thrift for RPC communication, future for Python 2/3 compatibility, and pywin32 for Windows support. It is designed for system administrators and security engineers who want to extend osquery's functionality or integrate osquery queries into Python applications. The dormant maintenance status (751 days since last release) means the package is stable but receives no active development.

Use it for:

- Build custom osquery table plugins in Python to expose internal APIs or proprietary data as queryable tables.
- Execute SQL queries against a running osqueryd daemon from a Python application to gather system state or security telemetry.
- Spawn ephemeral osquery instances from Python for one-off or batch system queries without managing a separate osquery process.
- Integrate osquery into Python-based security monitoring or incident response workflows via the Thrift client API.
- Extend osquery with Python logic for specialized hardware events, file hashing, or custom system introspection.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Python bindings for creating osquery extensions and querying osquery instances via SQL, allowing you to extend osquery with custom tables or execute queries against running osquery processes.

Yes, if you are already using osquery and need Python bindings to extend it or query it programmatically. The low install friction and permissive license are favorable. However, be aware that maintenance is dormant—no active development or bug fixes are expected—and the classifiers only list Python up to 3.6, so compatibility with newer Python versions is unverified. Use it for stable, established osquery deployments, not for new projects expecting ongoing support.

## Install

pip install osquery
uv add osquery
poetry add osquery

## Installing osquery

Before you install: Low install friction with a pure-Python wheel distribution. Maintenance is dormant—last release was 751 days ago—so expect no active bug fixes or feature development, though the package is marked Production/Stable.

License in practice: BSD permissive license means you can use, modify, and distribute this package with minimal restrictions, provided you retain the license notice.

Quickstart:

pip install osquery

import osquery

instance = osquery.SpawnInstance()
instance.open()
result = instance.client.query("select timestamp from time")

Verify before relying:

- Whether pywin32 is required on non-Windows platforms or is a conditional dependency
- Current compatibility with Python versions newer than 3.6 (classifiers list only up to 3.6)
- Whether the package works with modern osquery versions released after the last Python binding update

## Package facts

- License: BSD (permissive)
- Python support: unspecified
- Install friction: low
- Maintenance: dormant
- Downloads: 231.9K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

osquery python bindings, sql queries operating system, osquery extensions python, system monitoring sql, osquery client library, custom osquery tables, thrift osquery api, osquery, system-monitoring, sql-queries

[View on SkillFed](https://skillfed.io/packages/osquery) · [View on PyPI](https://pypi.org/project/osquery/)