Skip to main content
osctrl
All solutions

Solution · Security investigations

Scope incidents with live host state

Ask targeted questions across the fleet, inspect affected nodes, and send the results into the response workflow you already trust.

Deploy osctrl Read the docs
Solution brief

Live query · Focused scope · No remote shell

  • Vulnerability scope
  • Process context
  • Targeted collection

Time to truth

The next question should not wait for tomorrow's index

An alert starts the investigation. The next questions are usually about the systems around it: which process is running, which package version is installed, which socket is open, and where else the same state exists.

osctrl lets the team ask those questions across live endpoints without waiting for another collection cycle.

Incident scope

Turn an indicator into a fleet-wide question

SELECT pid, name, path, cmdline
FROM processes
WHERE path = '/tmp/suspicious';

Start with one endpoint, then run the same question across the relevant fleet to understand scope while the incident is active.

What changes

Operate from facts, not assumptions

Vulnerability scope

Find the systems with the affected version

Query installed software and configuration directly instead of treating the golden image as evidence.

Process context

See what is running now

Inspect processes, command lines, users, services, sockets, and persistence-related state exposed through osquery.

Targeted collection

Carve supporting evidence

Request a file or directory from the endpoint that matters and preserve it in your investigation workflow.

Environment boundaries

Keep investigation scope deliberate

Use separate environments and access controls so a broad query does not become a broad blast radius.

Existing response stack

Send answers to the tools that decide

Route results into your lake, SIEM, case system, or analytics pipeline instead of rebuilding those workflows inside osctrl.

How it works

From alert to grounded scope

  1. Ask the first node

    Use the node console or a targeted query to validate the host state behind the signal.

  2. Expand the scope

    Run the same SQL across the environment or fleet segment that could share the condition.

  3. Export the answers

    Send the results and carved evidence into the systems where your team handles response.

Clear boundary

Answers, not verdicts

osctrl does not ship a detection engine or threat intelligence feed. It gives your analysts current endpoint facts so the tools and people responsible for response can decide what they mean.

Choose your next step

Point it at ten machines this afternoon

Deploy the open-source control plane, enroll a small scope, and ask a real fleet question. No demo form stands between you and the quickstart.

Deploy osctrl Read the code
01

A fleet problem right now

Bring the machine state you cannot explain.

Talk to an engineer 02

Evaluating for my team

Walk through architecture, deployment, and fit.

Plan an evaluation 03

Running fleets for clients

See how environments separate enrollment and access.

Discuss multi-tenancy 04

Just looking

Start with the source and deployment guide.

Open the quickstart

MIT licensed underneath. Your agents, deployment, and data remain in your infrastructure.