<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Deploying Osquery Fleet

## osquery CLI

| Command | Description |
|---|---|
| `osqueryi` | Interactive SQL shell |
| `osqueryi --json "SELECT * FROM processes;"` | JSON output query |
| `osqueryctl config-check` | Validate configuration |
| `osqueryd --flagfile=/etc/osquery/osquery.flags` | Start daemon |
| `systemctl status osqueryd` | Check daemon status |

## FleetDM CLI (fleetctl)

| Command | Description |
|---|---|
| `fleetctl apply -f pack.yml` | Apply query pack |
| `fleetctl query --query "SELECT * FROM uptime;"` | Live query |
| `fleetctl get hosts` | List enrolled hosts |
| `fleetctl get packs` | List query packs |
| `fleetctl get queries` | List saved queries |

## Key Tables

| Table | Platform | Description |
|---|---|---|
| `processes` | All | Running processes |
| `listening_ports` | All | Open network ports |
| `users` | All | User accounts |
| `crontab` | Linux/macOS | Cron jobs |
| `suid_bin` | Linux | SUID binaries |
| `kernel_modules` | Linux | Loaded kernel modules |
| `authorized_keys` | Linux/macOS | SSH authorized keys |
| `chrome_extensions` | All | Browser extensions |
| `docker_containers` | Linux | Docker containers |
| `file` | All | File metadata and hashes |

## Agent Script

```bash
# List available queries
node agent.js list

# Get specific query
node agent.js get temp_processes

# Run query locally
node agent.js run "SELECT name, pid FROM processes LIMIT 10;"

# Generate query pack
node agent.js pack --queries processes_listening suid_binaries cron_jobs --interval 600
```
