Product · osquery fleet management
Enroll nodes, distribute configuration, query live state, inspect endpoints, collect evidence, alert on changes, and route results into your existing pipeline.
Browser UI · CLI · REST API · MCP
One control plane
Use the GUI, work from the CLI, or connect through osctrl-mcp. Every interface reaches the same fleet state and the same environment boundaries.
Fleet health
$ osctrl-cli --api shellconnected to osctrl-api ............ authenticatedactive environment ................. demo $ statsnodes enrolled ...................... 240nodes active ........................ 237nodes inactive ...................... 3queries running ..................... 3carves in progress .................. 1 $ use nodescontext ............................. nodes$ list inactiveHOSTNAME PLATFORM LAST SEENedge-proxy-07 linux 18m agofinance-mbp-214 darwin 31m agolab-win-22 windows 44m ago✓ 3 inactive nodes ready to filter, query, or inspectShow inactive Linux nodes in the demo environment.
GET /api/v1/nodes/demo/inactive
Authorization: Bearer ••••••••
filter.platform = linux3 inactive nodes returned inside the demo environment boundary.
The operating loop
The product handles the work around osquery so your team can use endpoint truth at fleet scale.
Fleet foundation
osctrl implements the osquery remote API through a TLS endpoint. Enroll nodes into explicit environments, keep their identity stable, and operate each boundary on purpose.
Central configuration
Distribute osquery configuration, flags, scheduled query packs, and saved queries from one place. Change the operating model once and let enrolled nodes pick it up.
Distributed SQL
Run on-demand distributed queries against the environment or nodes you choose. osctrl collects the results and keeps the node context attached.
Read-only investigation
Open a read-only, shell-like console backed by osquery. Browse directories, inspect processes, run SQL, and request a file without adding a general-purpose remote shell.
Files and results
Carve files or directories from a specific node. Collect osquery status and result logs. Keep both in storage and workflows your team already controls.
Optional alerting
Create rules for log matches and node state transitions. Scope them globally, by environment, or to one node, then notify webhook or email channels.
System status
Enable deployment health to check the database, Redis, service heartbeats, worker state, runtime statistics, and cached upgrade status from one operator view.
Trust and access
Fleet visibility is powerful. Access should be narrow, reviewable, and deliberate.
Authentication
JWT authentication is the default for osctrl-api. Password logins can add TOTP, passkeys or security keys, and recovery codes.
Federation
Configure OIDC or SAML providers for operator access without creating a separate identity island.
Authorization
Users and service tokens inherit explicit environment permissions. Cross-environment operations stay reserved for the roles that need them.
Audit
Audit records cover API actions, TLS security and service events, and activity through hosted MCP.
Automation safety
Read tools follow the caller's API permissions. Mutating MCP tools are gated separately and disabled by default.
Request controls
Trusted proxy controls, endpoint body limits, and configurable rate limits protect sensitive enrollment and login paths.
Your data path
The control plane manages collection. Your existing storage and analytics systems can remain the system of record.
Fleet data
Choose the database that fits the deployment. Redis supplies the shared caches, activity rollups, query dispatch hints, alert state, and event invalidation used by the services.
Carve storage
Keep file evidence close to the control plane or send it to object storage built for retention and review.
Log routing
Persist log sink configuration at the scope your operating model needs. Route environments differently without forking the platform.
Scale and multi-tenancy
Each environment gets its own enrollment, configuration, data scope, and operator permissions. Run one control plane for the organization or separate instances for customers with stricter boundaries.
A user only sees the environments their role permits. A query scoped to one environment stays scoped to its nodes.
Isolated enrollment
Dedicated operators
Separate configuration
Scoped access
Independent data
Platform team
Built in public
osctrl is MIT licensed and actively developed. The repository includes the services, operator UI, deployment assets, OpenAPI specification, architecture notes, and security policy.
It is used in production, but it is still evolving. Review the documentation and known constraints before putting it into a critical environment.
Choose your next step
Deploy the open-source control plane, enroll a small scope, and ask a real fleet question. No demo form stands between you and the quickstart.
Bring the machine state you cannot explain.
Talk to an engineerWalk through architecture, deployment, and fit.
Plan an evaluationSee how environments separate enrollment and access.
Discuss multi-tenancyStart with the source and deployment guide.
Open the quickstartMIT licensed underneath. Your agents, deployment, and data remain in your infrastructure.
