Skip to main content
osctrl

Live host truth for osquery fleets

Catch the one machine that drifted

Fleets drift. A reimage half-fails, one rack misses a hotfix, or a package updates itself. One SQL query checks every server and shows you what changed.

Get early access Explore the workflow

Linux · macOS · Windows · Self-hosted

Built on osquery. Operated with osctrl.

  • Linux, macOS, Windows
  • Self-hosted
  • MIT licensed

How it works

Your SQL. Your whole fleet

osquery turns host state into tables. osctrl makes it operable across a fleet.

Explore the product
osctrl Distributed queries Example workflow
New query Production
SELECT pid, name, path
FROM processes
WHERE name = 'sshd';
Read-only query · Scoped to your environment
Results Query complete
Illustrative process results returned by enrolled nodes
Nodepidnamepath
prod-eu-01842sshd/usr/sbin/sshd
prod-eu-02816sshd/usr/sbin/sshd
prod-us-01903sshd/usr/sbin/sshd

  1. Enroll your machines

    Connect osquery with an enrollment secret, or bake enrollment into your image. Group nodes into the environments your team operates.

    Linux · macOS · Windows

  2. Ask a fleet-wide question

    Write SQL against packages, processes, sockets, users, or kernel state. Scope it to an environment or the nodes you need to inspect.

    Ad hoc queries · Read-only node console

  3. Keep the answers coming

    Schedule the checks that matter. Route result and status logs into the storage, security, and analytics systems you already use.

    Query packs · Scheduled queries · Your data pipeline

Scale without crossing boundaries

One control plane.
Separate environments

A query stays scoped to the nodes you choose.

osctrlControl plane

  1. Production

    • Own enrollment secret
    • Own configuration and data scope
    • Platform team

  2. Customer A

    • Own enrollment secret
    • Own configuration and data scope
    • Customer A operators

  3. Customer B

    • Own enrollment secret
    • Own configuration and data scope
    • Customer B operators

Need a stricter boundary?
Run separate instances.

See environment controls

Solutions

Different fleets.
The same need for truth

Start with the fleet problem your team owns. The osquery foundation stays the same.

Cluster reliability

GPU clouds

Find the one bad node before it stalls a training run.

jmpsec / osctrl

MIT licensed

Open by design

Your infrastructure. Your call

An agent on every machine deserves inspection. Review the source, run it in your network, and choose where your data goes. Self-host, or bring us in for commercial support or a managed deployment.

Read the source on GitHub

FAQ

Frequently asked questions

Need the implementation detail? Nothing in the docs is gated

osquery exposes host state as SQL. osctrl adds fleet enrollment, configuration, distributed queries, node inspection, file carves, access boundaries, and result collection around it.
osctrl manages osquery fleets across Linux, macOS, and Windows. The tables available to a query depend on the endpoint platform and the extensions you deploy.
osctrl is built for fleets from hundreds to hundreds of thousands of nodes. Capacity depends on deployment topology, query cadence, and the data pipeline behind it.
No. Live queries and the node console use osquery. The console is intentionally limited to read-only inspection such as ps, ls, stat, and SQL.
You choose. Run osctrl in your environment and route status and query results into the storage, analytics, and security systems you already operate.
Yes. The core project is open source and the deployment documentation is public. Commercial support and managed deployments are also available.

Start with one environment

Ask your fleet
what’s really running

Enroll a few nodes. Run a query your team needs answered. Build from there.

Get early access Deploy it yourself