@Matt Brown osquery interfaces with the OS a few different ways and osquery is extensible a few other ways. a) It interfaces with the kernel (openbsm, kaudit, etc) to capture kernel behavioral activity/events (processes launched, socket connections, file changes etc). This is done via _event tables. b) It can scrape point in time OS state via scheduled queries. The queries can be scheduled to run as snapshot or differential (complex but very efficient) c) Over a TLS connection or via the CLI, one can ask live/ad-hoc queries d) Using config parsing lens - e.g. augeas one can parse various configs flies e) Using the thrift extension mechanism one can write extensions using C++, Python, Node, Go etc