Agent skill · security · aiskillstore
forensics-osquery
SQL-powered forensic investigation and system interrogation using osquery to query operating systems as relational databases. Enables rapid evidence collection, threat hunting, and incident response across Linux, macOS, and Windows endpoints. Use when: (1) Investigating security incidents and collecting forensic artifacts, (2) Threat hunting across endpoints for suspicious activity, (3) Analyzing running processes, network connections, and persistence mechanisms, (4) Collecting system state during incident response, (5) Querying file hashes, user activity, and system configuration for compromise indicators, (6) Building detection queries for continuous monitoring with osqueryd.
Why this skill is useful
Adds executable scripts for automated incident response triage and specific forensic queries that enhance the AI's capabilities in security investigations.
What it needs
Requires osquery installed locally. About 10k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
osquery Forensics & Incident Response Overview osquery transforms operating systems into queryable relational databases, enabling security analysts to investigate compromises using SQL rather than traditional CLI tools. This skill provides forensic investigation workflows, common detection queries, and incident response patterns for rapid evidence collection across Linux, macOS, and Windows endpoints. Core capabilities: SQL-based system interrogation for process, network, file, and user analysis Cross-platform forensic artifact collection (Linux, macOS, Windows) Live system analysis without deploying heavyweight forensic tools Threat hunting queries mapped to MITRE ATT&CK techniques Scheduled monitoring with osqueryd for continuous detection Integration with SIEM and incident response platforms Quick Start Interactive Investigation (osqueryi) One-Liner Forensic Queries Core Workflows Workflow 1: Initial Incident Response Triage For rapid assessment of potentially compromised systems: Progress: [ ] 1. Collect running processes and command lines [ ] 2. Identify network connections and listening ports [ ] 3. Check user accounts and recent logins [ ] 4. Examine persistence mechanisms (scheduled tasks, startup items) [ ] 5. Review suspicious file modifications and executions [ ] 6. Document findings with timestamps and process ancestry [ ] 7. Export evidence to JSON for preservation Work through each step systematically. Use bundled triage script for automated collection. Execute triage: ./scripts/osquerytriage.sh > incidenttriage$(date +%Y%m%d%H%M%S).json Workflow 2: Threat Hunting for Specific TTPs When hunting for specific MITRE ATT&CK techniques: 1. Select Target Technique Identify technique from threat intelligence (e.g., T1055 - Process Injection) Map technique to observable system artifacts See references/mitre-attack-queries.md for pre-built queries 2. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/forensics-osquery