Endpoint visibility, in ready-to-run queries.

A feed of osquery (endpoint hunting) queries aggregated from permissive open-source sources, every query validated against the real osquery schema (all tables exist), mapped to an ATT&CK tactic, its platform (Linux/macOS/Windows) and CIS benchmarks. Load into osquery, osqueryd or Fleet. Ed25519-signed.

1 550+
validated queries
196
ATT&CK techniques
3 OS
Linux · macOS · Windows
CIS
compliance benchmarks

What we added recently

A living feed: here is the coverage added to it, dated.

  • +115 requêtes
  • +57 requêtes

Curated, validated, mapped queries.

ATT&CK hunting

Every hunting query is tied to an ATT&CK tactic: Persistence (launchd, cron, services), Credential Access, Execution, Discovery, Command & Control, Defense Evasion. You hunt by tactic, not by file name.

Platform-indexed

Every query is tagged Linux, macOS or Windows (derived from the osquery schema when the source is silent). A per-platform bundle: deploy across your fleet without guessing what runs where.

CIS benchmarks

CIS policies (macOS/Windows hardening) are preserved and grouped: a ready-to-run “compliance” subset, separate from hunting. The audit angle, not only the hunt.

Schema-validated

Every query is checked against the official 369-table osquery catalog: the SQL parses and every table actually exists. No broken query, and none pointing at a phantom table, gets in. Deterministic, platform-independent.

Licensing: mixed

The aggregate comes from permissive open-source sources (MIT / Apache-2.0), attribution retained: that part stays redistributable, MSSP use included. But nearly half the pack is our forged MAISON queries, proprietary, (c) CyberConsulting.fr, under EULA: use within your own security operations, not redistributable. The curation, schema validation and ATT&CK/CIS mapping are our value.

In-house forged queries

Beyond the aggregate, we FORGE our own queries by converting our Sigma detections AND our proprietary YARA signatures to osquery (the ones whose semantics translate faithfully: process, registry, file, network), keeping their exact ATT&CK technique. This is the proprietary, non-clonable part of the pack, hundreds of hunting queries the public lists don’t have.

index.json + bundles

A normalized queries.json (id, SQL, platform[], tables[], tactics[], CIS, category), an index.json with the counts, and by-platform / by-tactic / by-category bundles. Filterable, scriptable, Fleet-ready.

Queries aggregated from des sources open-source permissives (MIT / Apache-2.0), deduplicated, each validated against the official osquery schema (369 tables), then mapped to ATT&CK + platform + CIS (index.json + bundles). The compilation and mapping are (c) CyberConsulting.fr; the queries keep their permissive license.

Anywhere osquery runs.

osquerydscheduled packs on the endpoint, results to your SIEM
Fleetquery library + policies, at fleet scale
osqueryiinteractive triage, live-response, IR
ThreatClawthe TC agent already runs osquery, the feed plugs straight in

osquery queries that don’t break in prod.

01
Validated on the osquery schema

The SQL parses and every referenced table exists in the official 369-table catalog. A query pointing at a phantom table (typo, missing extension) is dropped before delivery, no “no such table” at the customer.

02
Clear licensing, MSSP-friendly

The aggregate comes from permissive sources (MIT / Apache-2.0), attribution kept: an MSSP can redistribute it to its clients. Our maison queries (nearly half) are proprietary, under EULA (subscriber use). You know exactly what’s redistributable and what stays yours.

03
ATT&CK-mapped

Every hunting query carries its ATT&CK tactic(s), derived from the tables it reads. You cover a tactic, you document your coverage, you feed a report, not just a list of queries.

04
Three OSes, one feed

Linux, macOS and Windows in one pack, each query tagged to its platform. A heterogeneous fleet covered without juggling three sources.

05
Curated and deduplicated

The three sources overlap: duplicates (same normalized SQL) are merged. You get one clean set, not three overlapping lists.

06
Ed25519-signed

The pack is signed; you verify its integrity before every fleet deployment.

What is osquery again?

osquery exposes the operating system (processes, connections, scheduled tasks, extensions, users…) as a SQL database. You query your endpoints in SQL. It’s the open-source standard for endpoint visibility, used by SOC/IR teams and platforms like Fleet and Kolide.

Why validate on the schema, not osqueryd?

osquery tables are OS-specific: a macOS query (e.g. managed_policies) “fails” on a Linux runner even though the SQL is fine. Running osqueryd would therefore give false verdicts by platform. We validate against the official table catalog (the SQL parses + every table exists): it’s deterministic, platform-independent, and catches exactly the real defect, a non-existent table or a typo.

How do I use it?

The pack ships a normalized queries.json, an index.json and bundles/ by platform / tactic / category. Convert the bundle you want to the osquery pack format (JSON queries) or import it into Fleet. Deploy your platform’s bundle, schedule the hunting queries via osqueryd, send results to your SIEM. The CIS subset serves compliance audits.

What licenses, and can I resell / MSSP?

The pack is a proprietary subscription. The aggregated part comes from permissive open-source sources (MIT / Apache-2.0), attribution kept: it stays redistributable, MSSP use included. Our forged maison queries (nearly half the pack, converted from our Sigma detections and YARA signatures) are proprietary (c) CyberConsulting.fr, under EULA: use within your own security operations, not redistributable. You subscribe for that forge, the curation, the validation and the mapping, not for clonable queries.

Does it work with the ThreatClaw agent?

Yes, directly. The ThreatClaw agent already runs osquery on endpoints: the feed plugs in as a source of hunting queries, ATT&CK-mapped, with no extra tool. But the pack is standalone, it runs just as well with osqueryd/Fleet alone, no lock-in.

Ready to hunt across your endpoints?

Annual subscription. Instant key. Cancel anytime.

€349 / month, billed annually €4,188 excl. tax
Try before you buy: free demo pack

A sample of our in-house rules across every engine we run (Sigma, YARA, osquery, Velociraptor, Falco, network, policy), each detection with its investigation playbook in the CACAO 2.0 standard, importable into your SOAR. The Sigma rules come already converted for 6 SIEMs: Splunk, Sentinel, Elastic, QRadar, CrowdStrike and Panther. A NIS2 compliance-coverage sample is included. Generated without AI.

Download the demo pack .zip

What this pack does not cover

What we do not cover, we tell you

No one detects 100%, and a feed that claims otherwise burns out your analyst. Anything that does not compile on the real engine, or lights up on a benign corpus, never reaches the pack. What a rule cannot see, we show as a gap rather than paper over it. And by default the agent observes and proposes, acting only after human validation (human-in-the-loop). You buy signal, not volume.

Detection that holds up in front of the auditor

The question is no longer only “can I detect?” but “can I prove it?”. Every subscription ships with the compliance layer, at no extra cost.

Design coverage, not a certification nor a real-time measurement: it evidences that the catalogue addresses the requirement, your CISO validates compliance.

Detection guides

The method behind the pack, on our blog.