Sign in

Fleet Device Management
Open source endpoint visibility

A simple query for IP-Geolocation

SELECT JSON_EXTRACT(result, '$.ip') AS ip,
JSON_EXTRACT(result, '$.city') AS city,
JSON_EXTRACT(result…


Proper use of JOIN to return osquery data for users

$ osqueryi
Using a virtual database. Need help, type '.help'
osquery> SELECT uid, name FROM chrome_extensions LIMIT 3;
+-----+--------------------------------------------+
| uid | name |
+-----+--------------------------------------------+
| 501 | Slides…

Bug fixes


  • Improved performance
  • Software inventory
  • Running common queries

Improved performance


What is Orbit?

Why use Orbit as part of your deployment strategy?


New features

concat and concat_ws sql functions

osquery> SELECT 'hello' || NULL || 'world';
'hello' ||…


  • Agent auto-updates beta
  • Identity Provider-initiated Single Sign-On
  • Improved server logging

Agent auto-updates beta



  • Configurable host identifier
  • Upgrades to the UI

Configurable host identifier


  • Improvements to the navigation experience on the Hosts page
  • New logging plugin for AWS Lambda

Improvements to navigation experience on the Hosts page

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store