Use Cases

What teams do with osctrl

From day-to-day fleet visibility to deep incident response, osctrl turns your osquery deployment into an operational security platform.

🔭 Fleet visibility & endpoint monitoring

Know exactly what is running across your infrastructure. Every node enrolled with osctrl reports in over the osquery TLS remote API, giving you a live inventory of your fleet.

  • Real-time node status: online, offline, last seen, osquery version
  • Organize nodes by environments and tags (production, corp, laptops…)
  • Node activity tracking and optional GeoIP country enrichment
  • One UI for Linux, macOS and Windows endpoints

Benefit: a single source of truth for what's deployed, where it is, and whether it's healthy — without agents beyond osquery itself.

🕵️ Threat hunting & live investigation

Ask any question of any endpoint, in SQL, right now. Distributed on-demand queries let you hunt for indicators across the whole fleet or a targeted subset of nodes.

  • Run ad-hoc queries against thousands of nodes and stream results back
  • Accelerated distributed queries for near-interactive response times
  • Saved query library for repeatable hunts, with authenticated sample libraries
  • Built-in osquery schema awareness for query authoring (through osquery 5.23.1)

Benefit: reduce the time between "we think we're affected" and "here is the list of affected hosts" from days to minutes.

🚨 Incident response & forensics

When something goes wrong, osctrl gives responders direct, controlled access to the evidence — without SSH keys or remote desktop sessions.

  • Read-only node console: pwd, cd, ls, stat, ps, sql and more, backed by osquery
  • Carve files and directories from remote endpoints, with permission-checked get
  • Console acceleration scoped to the target node and fresh, active sessions
  • Audit logging of operator actions

Benefit: responders collect artifacts and inspect hosts safely — read-only, permission-checked and fully audited.

📋 Compliance & security posture

Continuously measure the security posture of your fleet using scheduled queries, and surface the results directly in the operator UI.

  • Optional posture ingestion from scheduled query prefixes
  • Track disk encryption, OS versions, patch levels, security agent health…
  • Scheduled query packs distributed centrally per environment
  • Status and result logs shipped to your compliance data pipeline

Benefit: evidence for auditors and dashboards for engineers, generated from the same osquery data you already collect.

🤖 Automation & integrations

Everything an operator can do in the UI is available programmatically. osctrl is built API-first, so it slots into your existing tooling.

  • REST API (osctrl-api) with JWT authentication and an OpenAPI specification
  • osctrl-cli for scripting, CI/CD and administration
  • Pluggable log destinations to feed your SIEM or data lake
  • Environment-scoped enrollment for automated fleet provisioning

Benefit: treat your endpoint telemetry as infrastructure — provisioned, queried and monitored by code.

🏢 Multi-environment fleet management

Separate business units, platforms or trust zones into isolated environments, each with its own enrollment secrets, configuration and query schedules.

  • Independent osquery configuration per environment
  • User and permission management scoped per environment
  • Scale from a home lab to hundreds of thousands of production nodes

Benefit: one osctrl deployment serves your whole organization while keeping teams and fleets cleanly separated.

Sound like your use case?

Deploy osctrl in minutes with Docker and see it with your own fleet.