What is Doorman

A free endpoint security tool for host investigative capabilities to find signs of malicious activity through memory and file analysis.

Doorman: An Osquery Fleet Management Tool

Doorman is an osquery fleet manager that enables administrators to manage osquery configurations from a distance, which are retrieved by nodes. Administrators can dynamically adjust the collection of packs, queries, and/or file integrity monitoring target paths by using tags. Doorman leverages osquery's TLS configuration, logger, and distributed read/write endpoints to provide administrators with visibility across a fleet of devices, all while maintaining minimal overhead and intrusiveness. At a glance, Doorman relies heavily on tags. A node's configuration is influenced by the tags it shares with packs, queries, and/or file paths. When tags are added or removed, the configuration of a node will change accordingly.

For example, it's possible to assign baseline tags to packs and queries

For example, you can assign a set of packs and queries a baseline tag. To make sure that all nodes receive this baseline configuration, simply assign the baseline tag to the nodes you want to include. State of the node: Click on any node to see its recent activity, original enrollment date, time of the last check-in, and the specific set of packs and queries that are configured for it.

This view provides a quick overview...

This view offers a quick overview of the current state of a node. Distributed queries: With Doorman, you have the ability to distribute a

Doorman Reviews

No reviews yet.

Similar Tools

Free
Endpoint Security

OSSEC

OSSEC is a robust, open-source Host-based Intrusion Detection System (HIDS) designed for comprehensive security monitoring and analysis across diverse platforms. Its advanced capabilities include deep log analysis, file integrity verification, rootkit detection, and real-time alerting, ensuring continuous protection against threats. OSSEC excels at centralized policy enforcement and active response, making it an indispensable tool for maintaining robust security postures in complex IT environments.

Scalable, multi-platform Host-based Intrusion Detection System (HIDS)Advanced log analysis and correlation engineFile integrity checking and monitoring
Free
Endpoint Security

ClamAV

ClamAV is a robust, open-source antivirus engine designed for comprehensive threat detection across diverse environments. Its versatile architecture is ideal for defending email gateways, web servers, and endpoints from malware, viruses, and other malicious threats. Optimized for scalability and performance, ClamAV offers a flexible multi-threaded daemon, efficient command-line tools, and automated signature updates, establishing itself as the de facto standard for secure email and network infrastructure.

Open-source Antivirus EngineEmail Gateway ScanningWeb Server Protection
Free
Endpoint Security

Zeek Agent

AhnLab PLUS is a unified security platform providing comprehensive cybersecurity solutions for businesses.

★ 5.0
Free
Endpoint Security

YARA-Endpoint

The official security guide for Red Hat Enterprise Linux 7, providing detailed information on securing the operating system.

★ 5.0

Do not let AI keep
recommending someone else

Start your 7-day free trial and get your AI Visibility Score in about a minute. See exactly where you stand, where competitors are beating you, and the ranked fixes to get into the answer. Cancel anytime before the trial ends.

7-day free trial. Cancel anytime before it ends. Trusted by 500+ B2B SaaS teams.

Partnered with
Powered by