---
sourceDocument: Xanadu IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/xanadu/it-operations-management

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Create an Agent Client Collector Security Incident Response OSQuery

# Create an Agent Client Collector
Security Incident Response OSQuery {#ariaid-title1}

* Release version: Xanadu
* 
* Updated August 1, 2024
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Define an OSQuery to gather information on a security incident's CI. OSQuery provides
an SQL layer on top of OS tables, and is bundled together with the Agent Client Collector as part of the base system.

## Before you begin

Role required: sn_si.admin

## Procedure

1. Navigate to AllAgent Client Collector SIR IntegrationACC Integration OSQuery.
2. Select New.  
   The ACC Integration OSQuery - New Record page appears.
3. Configure the fields on the page.  
   {#acc-create-os-query__table_ucj_pts_hsb__entry__2}

   | Field | Description |
   |-|-|
   | Name | A descriptive name for the query. |
   | Query | The query string. |
   [Table 1. ACC Integration OSQuery]

   {#acc-create-os-query__table_ucj_pts_hsb}
4. To validate that the Query you are writing works, select Test OSQuery.  
   The Test OSQuery page appears.{#acc-create-os-query__table_svt_svr_g5b__entry__2}

   | Field | Description |
   |-|-|
   | Agent | The specific end-point where the Query is run. |
   [Table 2. Test OSQuery]

   {#acc-create-os-query__table_svt_svr_g5b}
5. Enter the specific end-point Agent where the result of the test is displayed.  

* ![successful]() If it was successful
* ![large]() too large of an output
* ![error]() or an Error occurred with the error message displayed to the sn_si.admin.
{#acc-create-os-query__ul_lp1_y11_35b}

6. Select Submit.  
   OSQueries gather information on the target machine, where the incident commands are listed by operating system. For example, a query defined as select \* from system_info gathers all information from the OSQuery system_info table.

*[\>]: and then