osquery lets you query your Linux system like a database — every process, network socket, and file event becomes a SQL row. After six months running it in production as a self-hosted EDR, here is a complete setup guide covering installation, scheduled monitoring queries, file integrity detection, and a simple alert pipeline.