Comment by usrme

Thank you for the reply; however, I am still having a hard time understanding how exactly Osquery works under the hood. How does it communicate with other hosts? With what does it query for information once it reaches a remote node? What kind of overhead does it have in terms of network transfer when querying? Maybe I am completely off base and am mistaking how this works... Is Osquery set up on every individual host and I query for that information remotely using whatever tools I have at my disposal?