The following tables show which Carbon Black Cloud sensor versions support which versions of osquery for Audit and Remediation - Live Query.

Windows Sensor Support for osquery

Windows Sensor Version osquery Version
3.8.0.627 5.2.3
3.8.0.535 4.8.0
3.8.0.398 4.8.0
3.7.0.1503 4.8.0
3.7.0.1411 4.7.0
3.7.0.1253 4.5.0
3.6.0.2076+ 4.5.0
3.6.0.1719+ 4.4.0
3.5.0.1627+ 4.1.2
3.4.0.1016+ 3.3.2
3.3.0.984 3.2.6
Note: Carbon Black does not support x86 architecture (Windows 32-bit) for Live Query in any sensor version because osquery does not support it.

Linux Sensor Support for osquery

Linux Sensor Version osquery Version
2.12.x 5.0.1
2.11.x 4.8.0
2.10.x 4.5.0
2.9.0-2.9.1 4.4.0
2.8.0-2.8.3 4.1.2
2.7.0-2.7.1 4.1.2
2.6.0 3.3.2
2.5.0 3.3.2
2.4.0 3.3.2
2.2.0 None
2.1.0 None

macOS Sensor Support for osquery

macOS Sensor Version osquery Version
3.7.1 5.2.3
3.6.2 4.9.0
3.6.1 4.9.0
3.5.3 4.8.0
3.5.1 4.5.0
3.4.4 4.4.0
3.4.3 4.1.2
3.3.3 - 3.4.2 3.3.2
3.3.2 3.2.6
3.3.1 3.2.6