Welcome to the documentation for osquery with OpenFrame — the cross-platform OS instrumentation framework extended with AI-driven MSP automation by Flamingo and OpenFrame.
New to osquery? Start here.
| Guide | Description |
|---|---|
| Introduction | What is osquery with OpenFrame? Features and target audience |
| Prerequisites | System requirements, supported platforms, required software |
| Quick Start | Clone, build, and run osquery in under 10 minutes |
| First Steps | Explore virtual tables, scheduled packs, FIM, extensions, and OpenFrame |
Recommended reading order: Introduction → Prerequisites → Quick Start → First Steps
Guides for contributors and developers building on or extending osquery.
| Guide | Description |
|---|---|
| Environment Setup | IDE recommendations, clangd, ccache, editor extensions |
| Local Development | Build configurations, debug flags, GDB/LLDB, VS Code debugging |
| Guide | Description |
|---|---|
| Architecture Overview | High-level module breakdown, runtime lifecycle, design decisions |
| Guide | Description |
|---|---|
| Testing Guide | GTest/GMock structure, running tests, writing unit and integration tests |
| Security Best Practices | Auth patterns, AES-256-GCM, SQL authorizer, TLS, secrets management |
| Guide | Description |
|---|---|
| Contributing Guidelines | Code style, branch naming, commit format, PR process, virtual table creation |
Deep technical documentation for each core subsystem — generated directly from source code analysis.
| Module | Description |
|---|---|
| Core Init And Runtime | Process bootstrap, flags, watcher/worker model, watchdog |
| SQL Engine And Virtual Tables | SQLite engine, authorizer, virtual table binding, constraint pushdown |
| Configuration And Packs | Config loading, packs, schedulers, decorators, change detection |
| Eventing Framework And Subscriptions | Publisher/subscriber system, inotify, BPF, FSEvents, ETW |
| Extensions And IPC | Apache Thrift IPC, runtime plugin model, UUID routing |
| Distributed Querying | Remote SQL orchestration, TLS transport, fleet denylisting |
| Remote HTTP Client | Boost.Asio/Beast HTTPS client, TLS handshake, peer verification |
| Logging And Query Observability | Differential result tracking, JSON serialization, pluggable backends |
| Database And Storage Plugins | RocksDB persistent backend, ephemeral in-memory store, key-value interface |
| Filesystem And Path Utilities | Cross-platform file abstraction, glob resolution, permission enforcement |
Visual Mermaid diagrams for each subsystem are available in:
docs/diagrams/architecture/
Diagrams cover all major subsystems including the SQL engine, eventing framework, configuration pipeline, distributed querying, OpenFrame auth layer, and more. Open any .mmd file in a Mermaid-compatible viewer.
| Resource | Link |
|---|---|
| Project README | Main project overview, quick start, and features |
| Contributing Guide | How to contribute code, docs, and virtual tables |
| License | License information |
We do not use GitHub Issues or GitHub Discussions. All support and collaboration happens on OpenMSP Slack.
| Resource | Link |
|---|---|
| OpenMSP Community Slack | Join here |
| OpenMSP Website | https://www.openmsp.ai/ |
| OpenFrame Platform | https://openframe.ai |
| Flamingo | https://flamingo.run |
Documentation generated by OpenFrame Doc Orchestrator