Live Query is Supported on:
- Windows Clients running Windows 7+, 64-bit devices only
- Windows Servers running Windows 2008 R2+, 64-bit devices only
- macOS 10.10+
- macOS Catalina
- Red Hat 6+
- Red Hat 7
- CentOS 7
- Ubuntu 16.04+
- SUSE 12+
- OpenSUSE 15 & 42
- Amazon Linux 2
Additional Live Query Support Information:
- For Windows & macOS, an upgrade to the 3.3 sensor (or later) is required
- Sensor version 3.4.0.820+ is required if using a proxy for endpoints
- For Linux, an upgrade to the 2.3 sensor (or later) is required
- Users with "Use Live Query" privileges enabled in their role can run queries and view results
- Users with "View Live Query" privileges enabled in their role can only view results
- Live Query is powered by Osquery an open source project written in SQL