osctrl is an open-source osquery fleet manager, implementing the osquery remote API as a TLS endpoint. Full visibility and control over your endpoints — from hundreds to hundreds of thousands of nodes.
osquery gives you a SQL interface to every endpoint. osctrl makes that fleet manageable: enrollment, configuration, queries, logs and file carving — all from a modern operator UI, a REST API, or the CLI.
Track every system running osquery in real time — node status, activity, enrollment state and health across all your environments.
Push osquery configuration and scheduled query packs to your entire fleet in seconds, organized by environment and tags.
Ingest status and result logs from every node and route them to your logging pipeline of choice.
Launch distributed queries across any subset of nodes and get results back fast — with optional accelerated query reads.
Open a read-only, shell-like console against any node, backed by osquery: ls, ps, stat, sql, .tables and more.
Retrieve files and directories from remote endpoints for forensics and incident response, with permission-checked access.
Every osctrl component is a small, focused service built on shared Go packages, backed by PostgreSQL and Redis.
osctrl-tlsThe TLS endpoint implementing the osquery remote API. Handles node enrollment, configuration delivery, log ingestion, distributed queries and file carving for your entire fleet.
osctrl-apiThe REST API service, secured with JWT authentication by default, with trusted proxy controls and audit logging. Powers the operator UI and any automation you build. Fully documented with OpenAPI.
A modern React single-page application: nodes, environments, live and saved queries, carves, users, settings, node activity, posture data and the node console — all in one UI.
osctrl-cliThe operator command-line interface for scripting and administration — manage environments, nodes, queries and users from your terminal or CI, via API or direct DB mode.
Proven from hundreds to hundreds of thousands of nodes without compromising performance.
JWT auth by default, trusted proxy controls, audit logging and authenticated access throughout.
Optional posture ingestion, MaxMind GeoIP country enrichment and node activity tracking.
MIT licensed, actively developed, and already used in production environments.
Spin up the full stack locally with Docker Compose — TLS endpoint, API, frontend, PostgreSQL and Redis included.
# Clone the repository $ git clone https://github.com/jmpsec/osctrl.git $ cd osctrl # Build and run everything in Docker $ make docker_dev
Frontend at https://localhost:8444 · Legacy admin UI at https://localhost:8443
Full installation options: Docker, provisioning script, or building from source →
Free, open source, and ready to deploy today.