Skip to main content
osctrl
All solutions

Solution · Compliance evidence

Collect compliance evidence from the systems themselves

Turn scheduled osquery queries into repeatable evidence for configuration, software, encryption, and access controls.

Deploy osctrl Read the docs
Solution brief

Continuous evidence · Your queries · Your retention

  • Continuous collection
  • Scope
  • Traceability

Evidence gap

A policy is not proof that the control is working

Auditors ask for evidence from the systems in scope. Point-in-time screenshots and manual exports make every review a new collection project.

osctrl lets you define the query once, run it on a schedule, and preserve the results in the evidence pipeline you control.

Control evidence

Ask the endpoint for the control state

SELECT name, encrypted, type
FROM disk_encryption
WHERE encrypted = 0;

Use osquery tables to collect the facts behind a control, then retain and report them on your terms.

What changes

Operate from facts, not assumptions

Continuous collection

Replace manual snapshots with scheduled evidence

Run the same query across in-scope systems at a cadence that matches the control and keep each result tied to its node.

Scope

Separate evidence by environment

Keep production, corporate, regulated, and customer fleets in distinct enrollment and access boundaries.

Traceability

Keep the query beside the result

Version query packs with your engineering workflow so the evidence method is reviewable and repeatable.

Data ownership

Retain evidence in your own systems

Route results into the storage or analytics platform your compliance process already uses.

Exceptions

Find the systems that fall outside the control

Query for exceptions directly instead of inferring compliance from the image or management policy.

How it works

From control statement to system evidence

  1. Define the fact

    Translate the control into one or more osquery queries that return the state you need to prove.

  2. Schedule by scope

    Assign the query pack to the environments and systems covered by the control.

  3. Retain and report

    Send the results to your evidence store, preserve history, and investigate exceptions from the same source.

Clear boundary

Evidence collection, not automatic certification

osctrl collects system facts. Your control owners decide what those facts prove, how long to retain them, and how they map to a framework.

Choose your next step

Point it at ten machines this afternoon

Deploy the open-source control plane, enroll a small scope, and ask a real fleet question. No demo form stands between you and the quickstart.

Deploy osctrl Read the code
01

A fleet problem right now

Bring the machine state you cannot explain.

Talk to an engineer 02

Evaluating for my team

Walk through architecture, deployment, and fit.

Plan an evaluation 03

Running fleets for clients

See how environments separate enrollment and access.

Discuss multi-tenancy 04

Just looking

Start with the source and deployment guide.

Open the quickstart

MIT licensed underneath. Your agents, deployment, and data remain in your infrastructure.