Doorman

A free endpoint security tool for host investigative capabilities to find signs of malicious activity through memory and file analysis.

Doorman is an osquery fleet manager that enables administrators to manage osquery configurations from a distance, which are retrieved by nodes. Administrators can dynamically adjust the collection of packs, queries, and/or file integrity monitoring target paths by using tags. Doorman leverages osquery's TLS configuration, logger, and distributed read/write endpoints to provide administrators with visibility across a fleet of devices, all while maintaining minimal overhead and intrusiveness. At a glance, Doorman relies heavily on tags. A node's configuration is influenced by the tags it shares with packs, queries, and/or file paths. When tags are added or removed, the configuration of a node will change accordingly.

For example, you can assign a set of packs and queries a baseline tag. To make sure that all nodes receive this baseline configuration, simply assign the baseline tag to the nodes you want to include. State of the node: Click on any node to see its recent activity, original enrollment date, time of the last check-in, and the specific set of packs and queries that are configured for it.

This view offers a quick overview of the current state of a node. Distributed queries: With Doorman, you have the ability to distribute a