osquery

🚀 Bring your favorite shell wherever you go through the ssh.

Automate the creation of a lab environment complete with security tooling and logging best practices

A flexible control server for osquery fleets

Fleet is the lightweight, programmable telemetry platform for servers and workstations. Get comprehensive, customizable data from all your devices and operating systems — without the downtime risk.

A repository for using osquery for incident detection and response

Zentral provides a unified view for endpoint monitoring. Comprehensive features include Santa binary authorization and patch management orchestration on macOS, as well as detailed Qsquery fleet management - all paired with event based stream processing and direct support for a range of data store backends (Elastic, OpenSearch, SumoLogic, Splunk,…

DetectionLabELK is a fork from DetectionLab with ELK stack instead of Splunk.

Osquery launcher, autoupdater, and packager

Production-ready detection & response queries for osquery

Hubble is a modular, open-source security compliance framework. The project provides on-demand profile-based auditing, real-time security event notifications, alerting, and reporting. HubbleStack is a free and open source project made possible by Adobe. https://github.com/adobe

Go bindings for osquery

Fast and efficient osquery management

osquery extensions by Trail of Bits

[EXPERIMENTAL] Extend osquery to report on Kubernetes

Extension to osquery windows that enhances it with real-time telemetry, log monitoring and other endpoint data collection

Threat Hunting & Incident Investigation with Osquery

SIAC is an enterprise SIEM built on open-source technology.

kubequery powered by Osquery

Go app that dispatches osquery to multi-machines

Provide a shell like interface by utilizing osquery's distributed API