Create a Monitoring Query

Phase 4 — Monitoring & Policies · OpenFrame Onboarding

Where a policy judges a device (pass/fail), a query just collects data from it on a schedule. Use queries for visibility — inventory, performance, configuration — when you want the information but don't need a compliance verdict. They're osquery too, so it's the same SQL, different purpose.

Before you start

• You need an Admin role.
• Target devices need the Fleet/osquery agent installed and online.
• Decide your cadence up front: how often do you actually need this data refreshed? Hourly is plenty for most inventory; tighter intervals mean more frequent collection.

Create the query

1. Go to Monitoring → Queries → Add Query.
2. Name — what it collects, e.g. Windows Machine Summary.
3. Frequency — a number plus a unit (e.g. Minutes, Hours). This is the schedule the query runs on — e.g. set it to run every 1 hour.
4. Description — spell out what it gathers, e.g. Collects machine summary: hostname, CPU, memory, hardware details, OS version, and uptime for Windows devices.
5. Query — the osquery SQL that returns the data you want. Unlike a policy, you're not writing for pass/fail — you're selecting the columns you care about. The Osquery Documentation link lists the available tables.

Scheduled vs. on-demand

• Scheduled — the Frequency you set makes the query run automatically on that cadence, so the data stays fresh without you touching it.
• On-demand — click Test Query to run it right now against real devices. Use this to check your SQL works (and preview the output) before you commit to a schedule.

So: Test Query to prove it out once, Frequency to keep it running.

Assign devices

In the Devices section, choose which machines the query collects from — individually, filtered by Device Tags, or Add All Devices. Same selector as policies; full detail in Assign Devices to a Monitoring Policy. Scope it to where the data is relevant (e.g. a Windows-only summary → Windows devices).

Save

Click Save Query. It appears on the Queries tab with its Frequency shown (e.g. Every 1h), and starts collecting on schedule. Each row's … menu lets you manage it later.

Policy or query? A quick gut-check

• "Tell me which machines fail a standard" → Policy (Create Your First Monitoring Check).
• "Gather this data from these machines every hour" → Query (this guide).

You'll often use both: queries to see the lay of the land, policies to enforce the standards you care about.

Quick checklist

• Named the query and described what it collects
• Set a sensible Frequency
• Wrote the osquery SQL to return the columns you want
• Used Test Query to confirm output before scheduling
• Scoped it to the right devices, then saved

What's next

You can now both check and collect. Next, get precise about which devices these run on — Assign Devices to a Monitoring Policy — and learn how failures surface in Understanding Alerts — Triage & Resolution.

Based on OpenFrame v0.9.19. Screens and defaults may shift between releases — when in doubt, what's in your console wins.