osquery (Canonical build)

osquery exposes an operating system as a high-performance relational
database, enabling SQL-based queries over processes, files, network
connections, and other host state. Built on core22/LLVM-14 with BPF
support, packaged so it can run on any snapd-enabled host with a
compatible kernel, independent of the host distro's own userspace
library versions.

Confinement note: osquery's BPF backend needs perfevent/tracefs access
and effectively CAPSYSADMIN/CAPBPF-level privilege to trace syscalls
system-wide -- there is no strict-confinement interface that covers this,
so this snap requests classic confinement, the same effective privilege
the .deb already has.