Use Cases — osctrl

🔭 Fleet visibility & endpoint monitoring

Know exactly what is running across your infrastructure. Every node enrolled with osctrl reports in over the osquery TLS remote API, giving you a live inventory of your fleet.

Real-time node status: online, offline, last seen, osquery version
Organize nodes by environments and tags (production, corp, laptops…)
Node activity tracking and optional GeoIP country enrichment
One UI for Linux, macOS and Windows endpoints

Benefit: a single source of truth for what's deployed, where it is, and whether it's healthy — without agents beyond osquery itself.

🕵️ Threat hunting & live investigation

Ask any question of any endpoint, in SQL, right now. Distributed on-demand queries let you hunt for indicators across the whole fleet or a targeted subset of nodes.

Run ad-hoc queries against thousands of nodes and stream results back
Accelerated distributed queries for near-interactive response times
Saved query library for repeatable hunts, with authenticated sample libraries
Built-in osquery schema awareness for query authoring (through osquery 5.23.1)

Benefit: reduce the time between "we think we're affected" and "here is the list of affected hosts" from days to minutes.

🚨 Incident response & forensics

When something goes wrong, osctrl gives responders direct, controlled access to the evidence — without SSH keys or remote desktop sessions.

Read-only node console: pwd, cd, ls, stat, ps, sql and more, backed by osquery
Carve files and directories from remote endpoints, with permission-checked get
Per-node file explorer: accelerated, permission-checked directory listings and stat
Console acceleration scoped to the target node and fresh, active sessions
Audit logging of operator actions

Benefit: responders collect artifacts and inspect hosts safely — read-only, permission-checked and fully audited.

📋 Compliance & security posture

Continuously measure the security posture of your fleet using scheduled queries, and surface the results directly in the operator UI.

Optional posture ingestion from scheduled query prefixes
Track disk encryption, OS versions, patch levels, security agent health…
Scheduled query packs distributed centrally per environment
Status and result logs shipped to your compliance data pipeline

Benefit: evidence for auditors and dashboards for engineers, generated from the same osquery data you already collect.

🔔 Alerting & on-call

Turn the telemetry you already collect into notifications. Rules match against result, status and query logs, and against node state — a node going inactive, or coming back.

Scope a rule globally, to one environment, or to a single node
Fan out to webhook and email channels, with Redis-backed cooldown and dedupe
Dispatched history, so you can see what actually fired and when
Hot reload — rules take effect without restarting a service
Create a rule straight from a node's page; covered nodes show a marker

Benefit: stop watching dashboards. The fleet tells you when something changes, through the channels your team already reads.

🧠 AI-assisted fleet operations

osctrl speaks the Model Context Protocol, so an agent like Claude can answer questions about your fleet directly — without you writing a single integration.

Read tools for environments, fleet stats, node search and detail, the osquery schema, and query results
Run it as the osctrl-mcp stdio binary, or host it inside osctrl-api at /api/v1/mcp
Every tool call runs through the API's own permission checks as the calling user
Write tools — scheduling and expiring queries, tagging nodes — are a separate switch, off by default
Hosted MCP audit-logs every tool call, reads included

Benefit: "which macOS hosts are missing disk encryption?" becomes a question you ask, not a query you write — with the agent's reach bounded by its token.

🤖 Automation & integrations

Everything an operator can do in the UI is available programmatically. osctrl is built API-first, so it slots into your existing tooling.

REST API (osctrl-api) with JWT authentication and an OpenAPI specification
osctrl-cli for scripting, CI/CD and administration
Pluggable log destinations — S3, Kinesis, Kafka, Elasticsearch and more — to feed your SIEM or data lake
Per-environment log sink configuration, managed through the API
Environment-scoped enrollment for automated fleet provisioning

Benefit: treat your endpoint telemetry as infrastructure — provisioned, queried and monitored by code.

🏢 Multi-environment fleet management

Separate business units, platforms or trust zones into isolated environments, each with its own enrollment secrets, configuration and query schedules.

Independent osquery configuration per environment
User and permission management scoped per environment
Federated login through OIDC or SAML, with optional MFA for password accounts
Optional deployment health page covering database, Redis, services and upgrade status
Scale from a home lab to hundreds of thousands of production nodes

Benefit: one osctrl deployment serves your whole organization while keeping teams and fleets cleanly separated.

What teams do with osctrl