Manage osquery with ease.

Checkpost is an open-source osquery manager in a single binary.
Supports policies, queries, YARA scans and more.

GitHubFeatures

See it in action

A tour of the dashboard

  • Checkpost inventory listing enrolled hosts with status, owner, and platform

    Device inventory

  • Checkpost host detail page showing owner, group, and live device metrics

    Host details

  • Checkpost host policy results showing passing and failing posture checks for one machine

    Host compliance

  • Checkpost policies page with passing and failing posture checks per platform

    Compliance policies

  • Checkpost scheduled query list with descriptions

    Scheduled queries

  • Checkpost scheduled query results showing collected Linux package inventory

    Query results

  • Checkpost alert rules with severity and delivery targets

    Alerting

Features

Easy Enrollment

Bootstrap scripts for macOS, Linux, and Windows hosts.

Inventory

Track hosts, owners, asset IDs, groups, and last-seen state.

Scheduled Queries

Run queries on a schedule and send results to multiple backends for storage.

Policies

Use policies to perform checks across enrolled hosts for device posture.

YARA

Scan files for YARA matches.

Ad-hoc Queries

Run on-demand SQL queries against hosts.

Alerts

Configure alerts for policy failures

Access Control

Role based access control with SSO support.

GitOps

Use checkpost CLI to manage resources defined in YAML.