wazuh · javimed · Oct 3, 2025
diff --git a/source/deployment-options/deploying-with-ansible/reference.rst b/source/deployment-options/deploying-with-ansible/reference.rst
@@ -224,7 +224,7 @@ Wazuh Manager
 
 |
 | **Variable**: ``wazuh_manager_osquery``
-| **Description**: Configures the :doc:`wodle</user-manual/reference/ossec-conf/wodle-osquery>` item named ``osquery`` from ``ossec.conf``.
+| **Description**: Configures the wodle item named ``osquery`` from ``ossec.conf``.
 | **Default values**:
 
 .. code-block:: yaml
@@ -1039,7 +1039,7 @@ Wazuh Agent
 
 |
 | **Variable**: ``wazuh_agent_osquery``
-| **Description**: Configures the :doc:`wodle</user-manual/reference/ossec-conf/wodle-osquery>` item named ``osquery`` from ``ossec.conf``.
+| **Description**: Configures the wodle item named ``osquery`` from ``ossec.conf``.
 | **Default values**:
 
 .. code-block:: yaml
@@ -1056,7 +1056,7 @@ Wazuh Agent
 
 |
 | **Variable**: ``wazuh_agent_syscollector``
-| **Description**: Configures the :doc:`wodle </user-manual/reference/ossec-conf/wodle-syscollector>` item named ``syscollector`` from ``ossec.conf``.
+| **Description**: Configures the wodle item named ``syscollector`` from ``ossec.conf``.
 | **Default values**:
 
 .. code-block:: yaml

diff --git a/source/getting-started/use-cases/threat-hunting.rst b/source/getting-started/use-cases/threat-hunting.rst
@@ -90,8 +90,6 @@ Some third-party solutions that Wazuh integrates with to aid threat hunting are:
 
 - **URLHaus**: `Integrating URLHaus by abuse.ch <https://wazuh.com/blog/detecting-malicious-urls-using-wazuh-and-urlhaus/>`__ with Wazuh amplifies threat intelligence capabilities, empowering users to proactively detect and block malicious URLs in real-time.
 
-- **osquery**: Wazuh provides a module for managing the osquery tool from the Wazuh agents. The osquery module allows security analysts to configure and collect information generated by the osquery. It provides an extra layer for threat hunting capabilities such as configuration management, data collection, custom alerts based on osquery query results, and SQL-like syntax queries.
-
 - **MISP**: We can enrich Wazuh alerts by automating identifications of IOCs and integrating MISP with Wazuh.
 
 Wazuh integrates with other tools that aid threat hunting beyond the above-mentioned. It supports third-party integrations for threat intelligence platforms, SIEMs, and messaging platforms using APIs and other integration methods.

diff --git a/source/release-notes/release-3-7-0.rst b/source/release-notes/release-3-7-0.rst
@@ -156,7 +156,7 @@ The Wazuh app for Kibana includes new features and interface redesigns to make u
   - Get the current manager/agent configuration on the redesigned tabs.
   - Added support for multiple groups feature.
   - The :doc:`Amazon AWS </cloud-security/amazon/index>` tab has been redesigned to include better visualizations and the module configuration.
-  - The new :doc:`Osquery </user-manual/capabilities/system-inventory/osquery>` extension shows scans results from this Wazuh module.
+  - The new Osquery extension shows scans results from this Wazuh module.
   - Added a new selector to check the cluster nodes’ status and logs on the *Management > Status/Logs* tabs.
   - Several bugfixes, performance improvements, and compatibility with the latest Elastic Stack version.
 

diff --git a/source/user-manual/capabilities/system-inventory/index.rst b/source/user-manual/capabilities/system-inventory/index.rst
@@ -27,4 +27,3 @@ Users can generate system inventory reports from the Wazuh dashboard, which can
       available-inventory-fields
       compatibility-matrix
       using-syscollector-information-to-trigger-alerts
-      osquery
diff --git a/source/user-manual/capabilities/system-inventory/osquery.rst b/source/user-manual/capabilities/system-inventory/osquery.rst
diff --git a/source/user-manual/reference/centralized-configuration.rst b/source/user-manual/reference/centralized-configuration.rst
@@ -19,7 +19,6 @@ Agents can be configured remotely by using the ``agent.conf`` file. The followin
 -  :doc:`Security Configuration Assessment <../capabilities/sec-config-assessment/index>` (**sca**)
 -  :doc:`System inventory <../capabilities/system-inventory/index>` (**syscollector**)
 -  :doc:`Avoid events flooding <ossec-conf/client-buffer>` (**client_buffer**)
--  :doc:`Configure osquery wodle <ossec-conf/wodle-osquery>` (**wodle name="osquery"**)
 
 .. note::
   When setting up remote commands in the shared agent configuration, **you must enable remote commands for Agent Modules**. This is enabled by adding the following line to the ``/var/ossec/etc/local_internal_options.conf`` file in the agent:

diff --git a/source/user-manual/reference/daemons/wazuh-modulesd.rst b/source/user-manual/reference/daemons/wazuh-modulesd.rst
@@ -45,10 +45,6 @@ The wazuh-modulesd program manages the Wazuh modules described below.
 
   The Vulnerability Detector module detects applications that are known to be vulnerable (affected by a CVE).
 
-.. topic:: Osquery wodle
-
-  The Osquery wodle provides the user with an operating system instrumentation tool that makes low-level operating system analytics and monitoring both efficient and intuitive using SQL-based queries. For more information, read through the documentation for :doc:`osquery integration </user-manual/capabilities/system-inventory/osquery>`.
-
 .. topic:: SCA module
 
   The :ref:`SCA module <manual_sec_config_assessment>` allows users to check the system configuration against policy files to determine vulnerabilities and misconfigurations.

diff --git a/source/user-manual/reference/ossec-conf/index.rst b/source/user-manual/reference/ossec-conf/index.rst
@@ -107,8 +107,6 @@ Wazuh can be installed in two ways: as a manager by using the "server/manager" i
 +---------------------------------------------------------------------+------------------------+
 | :doc:`wodle name="docker-listener" <wodle-docker>`                  | manager, agent         |
 +---------------------------------------------------------------------+------------------------+
-| :doc:`wodle name="osquery" <wodle-osquery>`                         | manager, agent         |
-+---------------------------------------------------------------------+------------------------+
 | :doc:`wodle name="syscollector" <wodle-syscollector>`               | manager, agent         |
 +---------------------------------------------------------------------+------------------------+
 | :doc:`gcp-pubsub <gcp-pubsub>`                                      | manager, agent         |
@@ -162,7 +160,6 @@ All of the above sections must be located within the top-level ``<ossec_config>`
    wodle-s3
    wodle-syscollector
    wazuh-db-config
-   wodle-osquery
    wodle-docker
    wodle-azure-logs
    wodle-agent-key-polling