Osquery Manager integration

<div class="condensed-table">
| | |
| --- | --- |
| Version | 1.15.0 (View all) |
| Compatible Kibana version(s) | 8.16.0 or higher |
| Supported Serverless project types
What’s this? | Security |
| Subscription level
What’s this? | Basic |
| Level of support
What’s this? | Elastic |

</div>
With this integration, you can centrally manage Osquery deployments to Elastic Agents in your Fleet and query host data through distributed SQL.

This integration adds an Osquery UI in Kibana where you can:

• Run live queries for one or more agents
• View a history of past queries and their results
• Schedule queries to capture OS state changes over time
• Save queries and build a library of queries for specific use cases

Osquery results are stored in Elasticsearch, so that you can use the power of the stack to search, analyze, and visualize Osquery data.

For information about using Osquery, see the Osquery Kibana documentation. This includes information about required privileges; how to run, schedule, and save queries; how to map osquery fields to ECS; and other useful information about managing Osquery with this integration.

For a full list of fields that can be returned in osquery results, see the Exported Fields reference in the Kibana documentation.