kCQL provides access to operating system data, e.g., running processes or open network sockets. Moreover, kCQL can be added as a library to any userspace programm. Using that, an user can combine kernel and userspace data from different processes. Unlike others, kCQL allows access to a kernel's or programm's state as well as to events such as incoming network packets. Access is provided using a SQL-like language called CQL (Continous Query Language) which has been developed by Standford University. The implementation of CQL, called STREAMS, is used as the basis on which kCQL is build on.