Comment by cv_h
11 days ago
I’m working on https://checkpost.dev, a lightweight and easy-to-use osquery manager. It is open source, easy to self-host, and ships as a single binary. It only requires osquery to be installed on the endpoints. Checkpost is readonly and doesn't make any changes on the enrolled hosts.
It can run adhoc or scheduled queries and send the results to ClickHouse, or store them locally in Parquet files and use DuckDB to browse the results. It can also initiate YARA scans and collect the results. It also supports policy evaluation and alerting.
Nice. What's the end-goal of this product look like in next 2 years ?
I’m already happy with the current set of features, and I don’t expect to add many new ones. I want Checkpost to be something you can host once and spend very little time managing.
One of my goals while building it was to use it for device posture checks. Currently, alerts can be integrated with VPNs and proxies to allow or deny requests from devices that fail certain checks, but this requires manually parsing the webhooks. Over the next couple of years, I plan to focus on making those integrations easier and more seamless.
Edit: One major feature I’d like to explore is device identity and attestation using TPMs or secure enclaves. This could allow Checkpost to verify that requests are only coming from enrolled devices.