osquery
Named by 4 kept items in this workspace.
3 items name it under tools and 1 under classification.technologies.
Search every workspace for osquery. It matches the name as written, so it can find other things that share it.
The items that name it 4
Endpoint querying; its new yara_process table was used to hunt in-memory malware, with custom containerd_* tables for container process trees.
open-source runtime security defender, cited as comparison for other runtimes
Telemetry/query engine used by Fleet, including the parse_json table used to read bagel's JSON scan results.
All technologies in this workspace.