Skip to main content
osctrl
All solutions

Solution · Endpoint operations

Know what is true across every endpoint

Query live state, distribute osquery configuration, and investigate individual systems from one control plane.

Deploy osctrl Read the docs
Solution brief

Linux · macOS · Windows · One operating model

  • Current inventory
  • Configuration
  • Focused investigation

Fleet operations

Endpoint truth should not depend on a remote session

Configuration tools tell you what they intended to install. Inventory systems tell you what they last observed. Neither answers the next question on a live machine.

osctrl gives endpoint and security teams one place to ask, schedule, and collect osquery data across mixed operating systems.

Live endpoint query

Find the systems that need attention

SELECT name, version, install_location
FROM programs
WHERE name LIKE '%OpenSSL%';

Target the relevant environment or nodes, run SQL, and get the current answer from the endpoint itself.

What changes

Operate from facts, not assumptions

Current inventory

See software, users, processes, and sockets

Use the tables osquery already exposes to answer operational and security questions without deploying another broad agent.

Configuration

Ship query packs and schedules centrally

Keep osquery flags, packs, and recurring queries consistent as devices move between teams and environments.

Focused investigation

Inspect a node without a general remote shell

Use read-only osquery primitives to answer the next question on a system while keeping the execution surface narrow.

Evidence collection

Carve the file that matters

Request files or directories from a specific endpoint and bring them into an investigation you control.

Open pipeline

Keep using your existing data stack

Send status and query results to the storage, analytics, and security systems your team already operates.

How it works

One operating model for mixed fleets

  1. Create environments

    Separate enrollment, configuration, and access around the boundaries your organization already uses.

  2. Enroll osquery

    Connect existing agents or include enrollment in the device build process.

  3. Operate from GUI, CLI, or API

    Use the interface that fits the task without changing the underlying control plane.

Designed to coexist

Keep MDM and EDR where they fit

osctrl is the osquery control plane. It does not replace device policy enforcement or an EDR verdict engine. It gives both teams a direct path to current host state.

Choose your next step

Point it at ten machines this afternoon

Deploy the open-source control plane, enroll a small scope, and ask a real fleet question. No demo form stands between you and the quickstart.

Deploy osctrl Read the code
01

A fleet problem right now

Bring the machine state you cannot explain.

Talk to an engineer 02

Evaluating for my team

Walk through architecture, deployment, and fit.

Plan an evaluation 03

Running fleets for clients

See how environments separate enrollment and access.

Discuss multi-tenancy 04

Just looking

Start with the source and deployment guide.

Open the quickstart

MIT licensed underneath. Your agents, deployment, and data remain in your infrastructure.