What are the current pain points of osquery?

Summary: Trail of Bits interviewed teams at five major tech firms and osquery developers, who cited pain points including false negatives in file integrity monitoring caused by audit backend bugs that went unchecked since FIM was enabled in 2015, and Windows real-time data limited to the Windows Event Log, which no interviewed user had successfully parsed. Users also reported runaway queries degrading endpoint performance, a watchdog that kills well-formed audit queries by ignoring what is running, and roughly 15% of nodes at one company persisting as pending for unknown reasons.
Why it matters: A file integrity monitoring component that produced inaccurate logs for years, and a Windows port whose real-time data no interviewed user could parse, mean the tool's incident-detection value depends on gaps users may not know they have.

Read the original at Trail of Bits Blog ↗

Topics: Supply Chain & AppSec
Related: Kitesurf is now open source Cyber Risks · Nov 13, 2026
Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026
ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026