osquery

Automate the creation of a lab environment complete with security tooling and logging best practices

🚀 Bring your favorite shell wherever you go through the ssh.

A flexible control server for osquery fleets

Open source device management, built on osquery.

A repository for using osquery for incident detection and response

Zentral is an open-source solution for infrastructure monitoring and endpoint event stream processing. It provides build-in orchestration of macOS security components (Santa, Osquery, et-al.), event correlation and event management. It consolidates its features with various data store backends (ElasticStack, Azure Log Analytics, Splunk, et-al.).

DetectionLabELK is a fork from DetectionLab with ELK stack instead of Splunk.

Osquery launcher, autoupdater, and packager

Hubble is a modular, open-source security compliance framework. The project provides on-demand profile-based auditing, real-time security event notifications, alerting, and reporting. HubbleStack is a free and open source project made possible by Adobe. https://github.com/adobe

Go bindings for osquery

Fast and efficient osquery management

[EXPERIMENTAL] Extend osquery to report on Kubernetes

Extension to osquery windows that enhances it with real-time telemetry, log monitoring and other endpoint data collection

Threat Hunting & Incident Investigation with Osquery

SIAC is an enterprise SIEM built on open-source technology.

Go app that dispatches osquery to multi-machines

Recon Hunt Queries

A simple threat hunting tool based on osquery, Salt Open and Cymon API

kubequery powered by Osquery

[DEPRECATED] A quickstart demo for Kolide tools

node.js client for osquery

Manage, monitor and improve your cyber security posture.

osquery table extension that allows querying of information from the macOS private SystemPolicy.framework

Scripts to return inventory information for use in the JamfPro, heavily leveraging osquery

Fleet's lightweight osquery runtime and autoupdater.

⁇ 'osquery' 'DBI' and 'dbplyr' Interface for R

A starter-kit for a source-controlled, CLI-based osquery management workflow.

Community Edition of the PolyLogyx Endpoint Security Platform; An open source and extensible platform to manage and monitor endpoints, based on osqery agent