# osquery integration **URL:** \ **Category:** Zeek\ **Created:** [February 23, 2017, 11:29pm UTC](https://community.zeek.org/t/osquery-integration/4692 "2017-02-23T23:29:40Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [February 23, 2017, 11:29pm UTC](https://community.zeek.org/t/osquery-integration/4692/1 "2017-02-23T23:29:40Z")
I wanted to send a pointer to a new integration project that Steffen Haas presented at Bro4Pros recently: He wrote an osquery ([https://osquery.io](https://osquery.io)) extension that connects the host monitor to Bro, through Broker. The extension, along with a corresponding Bro script framework, allows turning osquery's SQL-style queries into real-time Bro event streams reflecting host-level activity. As an example, one can ask osquery to send an event every time there's a new USB device on a host, and then write a Bro script that processes these events as they come in, just as any other Bro events. One can turn such host activity into Bro log files for example, or correlate with the network activity Bro is seeing. The extension is currently in prototype state, we're working with the osquery team to integrate it directly into their distribution---a corresponding PR is open. In the meantime, we'd appreciate feedback, either here on the list or through GitHub. You can find the project at [GitHub - bro/bro-osquery: Bro integration with osquery](https://github.com/bro/bro-osquery) . For more context, see the Steffen's Bro4Pro slides: [https://www.bro.org//bro4pros2017/Haas\_OSquery\_Bro4Pros2017.pdf](https://www.bro.org//bro4pros2017/Haas_OSquery_Bro4Pros2017.pdf) Robin ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/osquery-integration/4692/2 "2022-05-06T15:44:40Z")
Closed on May 6, 2022, 3:44pm UTC