osquery

🚀 Bring your favorite shell wherever you go through the ssh.

Automate the creation of a lab environment complete with security tooling and logging best practices

Open-source device management for IT and security teams with thousands of laptops and servers. (macOS, Windows, Linux, ChromeOS, AWS, Google Cloud, Azure, data center, containers)

A flexible control server for osquery fleets

A repository for using osquery for incident detection and response

Zentral manages endpoint configuration for MDM, Osquery, Munki, Google Santa, and automates it's workflows through GitOps. It unifies events, collects IT asset info, and offers unique KPIs and metrics. Additionally, Zentral sources info from existing management systems, serves data for SIEMs and CMDBs, and brings efficient endpoint security posture

DetectionLabELK is a fork from DetectionLab with ELK stack instead of Splunk.

Osquery launcher, autoupdater, and packager

Production-ready detection & response queries for osquery

Hubble is a modular, open-source security compliance framework. The project provides on-demand profile-based auditing, real-time security event notifications, alerting, and reporting. HubbleStack is a free and open source project made possible by Adobe. https://github.com/adobe

Go bindings for osquery

Fast and efficient osquery management

osquery extensions by Trail of Bits

[EXPERIMENTAL] Extend osquery to report on Kubernetes

Extension to osquery windows that enhances it with real-time telemetry, log monitoring and other endpoint data collection

Threat Hunting & Incident Investigation with Osquery

SIAC is an enterprise SIEM built on open-source technology.

Go app that dispatches osquery to multi-machines

Provide a shell like interface by utilizing osquery's distributed API

Recon Hunt Queries