Skip to main content

MDM Query (OSQuery)

Overview​

MDM Query provides a powerful interface for running OSQuery commands across your device fleet. Get detailed system information, troubleshoot issues, and gather compliance evidence.

What is OSQuery?​

OSQuery exposes the operating system as a relational database:

  • Query system state with SQL-like syntax
  • Cross-platform support (Windows, macOS, Linux)
  • Real-time and historical data
  • Low performance impact

Query Interface​

Running Queries​

  1. Navigate to Devices → MDM Query
  2. Select target devices:
    • Single device
    • Device group
    • All devices
  3. Enter or select query
  4. Click Run Query
  5. View results

Query Syntax​

Queries use SQL-like syntax:

SELECT * FROM users WHERE uid > 500;
SELECT name, version FROM programs
WHERE name LIKE '%chrome%';
SELECT pid, name, cmdline FROM processes
WHERE on_disk = 0;

Common Queries​

System Information​

OS Version:

SELECT * FROM os_version;

Hardware Info:

SELECT * FROM system_info;

Uptime:

SELECT * FROM uptime;

Security​

Running Processes:

SELECT pid, name, path, cmdline
FROM processes;

Listening Ports:

SELECT pid, port, protocol, address
FROM listening_ports;

Installed Certificates:

SELECT * FROM certificates;

Firewall Status:

SELECT * FROM alf; -- macOS
SELECT * FROM windows_firewall_rules; -- Windows

Software​

Installed Programs:

SELECT name, version, install_date
FROM programs; -- Windows

SELECT name, bundle_version
FROM apps; -- macOS

Browser Extensions:

SELECT * FROM chrome_extensions;
SELECT * FROM firefox_addons;

Users​

Local Users:

SELECT * FROM users;

Logged In Users:

SELECT * FROM logged_in_users;

Last Login:

SELECT * FROM last;

Query Library​

Saved Queries​

Save frequently used queries:

  1. Write or run query
  2. Click Save Query
  3. Enter name and description
  4. Assign to category
  5. Save

Pre-built Queries​

Bastion includes pre-built queries for:

CategoryExamples
SecurityOpen ports, suspicious processes
ComplianceEncryption status, AV installed
InventoryHardware, software, users
TroubleshootingDisk space, memory, network

Query Scheduling​

Scheduled Queries​

Run queries automatically:

  1. Create or select query
  2. Click Schedule
  3. Configure:
    • Frequency (hourly, daily, weekly)
    • Target devices
    • Data retention
  4. Enable schedule

Use Cases​

  • Daily inventory collection
  • Hourly security checks
  • Weekly compliance verification
  • Change detection

Live Queries​

Real-Time Execution​

For immediate results:

  1. Select devices
  2. Run query
  3. Results stream in real-time
  4. View per-device results

Timeout Handling​

ScenarioBehavior
Device onlineReturns results
Device offlineMarked as unavailable
Query timeoutPartial results + timeout indicator

Query Results​

Viewing Results​

Results displayed in table format:

  • Sort by any column
  • Filter results
  • Export to CSV/Excel
  • Compare across devices

Result Actions​

ActionDescription
ExportDownload as CSV
SaveStore results historically
CompareCompare to previous results
AlertCreate alert based on results

Device-Specific Queries​

Single Device​

Query one device for troubleshooting:

  1. Go to Devices → Device List
  2. Select device
  3. Click Query
  4. Run query against that device

Query History​

View past queries for a device:

  • Previous queries run
  • Results returned
  • Timestamp
  • Query source (manual, scheduled)

Security Considerations​

Query Permissions​

PermissionAccess
ReadView results only
ExecuteRun pre-built queries
CustomWrite custom queries
AdminAll query capabilities

Query Auditing​

All queries are logged:

  • User who ran query
  • Query content
  • Target devices
  • Timestamp
  • Results (optional)

Best Practices​

Start with Pre-built

Use pre-built queries as starting points. They're tested and optimized.

Test on Single Device

Test new queries on one device before running fleet-wide.

Mind Performance

Complex queries on many devices can impact performance. Use appropriate filters.

Schedule Wisely

Don't over-schedule. Running queries too frequently wastes resources.

OSQuery Reference​

Useful Tables​

TableDescriptionPlatform
processesRunning processesAll
usersUser accountsAll
listening_portsOpen network portsAll
programsInstalled softwareWindows
appsInstalled applicationsmacOS
deb_packagesInstalled packagesDebian/Ubuntu

Documentation​

For complete OSQuery documentation:

Next Steps​

Web Browsing

Configure browser security

Security Checks

Create device policies