osquery

osquery.io

osquery is a system analysis and insight tool, allowing to answer questions about Windows, mac OS and Linux systems using SQL. We are currently ASSESSing its usage at sandstorm.

As we do not have any big experiences yet with osquery, we cannot highlight benefits and drawbacks yet.

Alternatives

• We've used OSSEC as HIDS in the past and plan to migrate to osquery, as OSSEC does not seem to be properly maintained anymore.