A flexible control server for osquery fleets

A repository for using osquery for incident detection and response

Zentral is an open-source solution for infrastructure monitoring and endpoint event stream processing. It provides build-in orchestration of macOS security components (Santa, Osquery, et-al.), event correlation and event management. It consolidates its features with various data store backends (ElasticStack, Azure Log Analytics, Splunk, et-al.).

Osquery launcher, autoupdater, and packager

Hubble is a modular, open-source security compliance framework. The project provides on-demand profile-based auditing, real-time security event notifications, alerting, and reporting. HubbleStack is a free and open source project made possible by Adobe. https://github.com/adobe

Go bindings for osquery

DetectionLabELK is a fork from DetectionLab with ELK stack instead of Splunk.

osquery extensions by Trail of Bits

Fast and efficient osquery management

Extension to osquery windows that enhances it with real-time telemetry, log monitoring and other endpoint data collection

SIAC is an enterprise SIEM built on open-source technology.

Go app that dispatches osquery to multi-machines

Provide a shell like interface by utilizing osquery's distributed API

A community-oriented fork of osquery with support for cmake, public CI testing, and regular releases

A simple threat hunting tool based on osquery, Salt Open and Cymon API

[DEPRECATED] A quickstart demo for Kolide tools

Recon Hunt Queries

Scripts to return inventory information for use in the JamfPro, heavily leveraging osquery

Simple Docker-based quickstart for osquery, Fleet, and ELK stack

node.js client for osquery

⁇ 'osquery' 'DBI' and 'dbplyr' Interface for R

osquery table extension that allows querying of information from the macOS private SystemPolicy.framework

A starter-kit for a source-controlled, CLI-based osquery management workflow.

Data files for use with hubble

A Chef Cookbook to install and configure osquery.

Repository containing Jupyter Notebooks for working with OSQuery tables and data

ALPHA/WIP for OSquery configuration for Mac and Linux Operating Systems

🚨an osquery powered, almost cross platform HIDS

OSQuery GraphQL web service.