Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hey folks - We're currently investigating a Fleet server performance issue related to the latest osquery release and SentinelOne. If you're an S1 and Fleet customer, would you please let me know? If you're not, you can disregard. Thanks!

Context and background: _osquery <https://github.com/osquery/osquery/releases/tag/5.23.0|v5.23.0> was released today (May 5th) as part of our fleetd agent (aka `orbit`). <https://github.com/osquery/osquery/releases/tag/5.23.0|v5.23.0> included a change to prevent keychain corruption caused when querying the `certificates` table (see <https://github.com/fleetdm/fleet/issues/43313|#43313>). to prevent keychain corruption, <https://github.com/osquery/osquery/pull/8840|this> change performs a temporary copy of the keychain files to a temporary folder, use the Apple APIs to access the keychain and after processing the results the temporary copies are removed. we believe S1 is now flagging this new behavior (`keychain_credential_collection_tmp`)_

We're planning a patch 4.84.3 to address some performance issues that we've seen with Fleet + S1 + osquery v5.23.0, but also urge folks to report any false positives to S1 support.