Endpoint visibility, in ready-to-run queries.
A feed of osquery (endpoint hunting) queries aggregated from permissive open-source sources, every query validated against the real osquery schema (all tables exist), mapped to an ATT&CK tactic, its platform (Linux/macOS/Windows) and CIS benchmarks. Load into osquery, osqueryd or Fleet. Ed25519-signed.
What we added recently
A living feed: here is the coverage added to it, dated.
- +115 requêtes
- +57 requêtes
Curated, validated, mapped queries.
Every hunting query is tied to an ATT&CK tactic: Persistence (launchd, cron, services), Credential Access, Execution, Discovery, Command & Control, Defense Evasion. You hunt by tactic, not by file name.
Every query is tagged Linux, macOS or Windows (derived from the osquery schema when the source is silent). A per-platform bundle: deploy across your fleet without guessing what runs where.
CIS policies (macOS/Windows hardening) are preserved and grouped: a ready-to-run “compliance” subset, separate from hunting. The audit angle, not only the hunt.
Every query is checked against the official 369-table osquery catalog: the SQL parses and every table actually exists. No broken query, and none pointing at a phantom table, gets in. Deterministic, platform-independent.
The aggregate comes from permissive open-source sources (MIT / Apache-2.0), attribution retained: that part stays redistributable, MSSP use included. But nearly half the pack is our forged MAISON queries, proprietary, (c) CyberConsulting.fr, under EULA: use within your own security operations, not redistributable. The curation, schema validation and ATT&CK/CIS mapping are our value.
Beyond the aggregate, we FORGE our own queries by converting our Sigma detections AND our proprietary YARA signatures to osquery (the ones whose semantics translate faithfully: process, registry, file, network), keeping their exact ATT&CK technique. This is the proprietary, non-clonable part of the pack, hundreds of hunting queries the public lists don’t have.
A normalized queries.json (id, SQL, platform[], tables[], tactics[], CIS, category), an index.json with the counts, and by-platform / by-tactic / by-category bundles. Filterable, scriptable, Fleet-ready.
Queries aggregated from des sources open-source permissives (MIT / Apache-2.0), deduplicated, each validated against the official osquery schema (369 tables), then mapped to ATT&CK + platform + CIS (index.json + bundles). The compilation and mapping are (c) CyberConsulting.fr; the queries keep their permissive license.
Anywhere osquery runs.
osquery queries that don’t break in prod.
The SQL parses and every referenced table exists in the official 369-table catalog. A query pointing at a phantom table (typo, missing extension) is dropped before delivery, no “no such table” at the customer.
The aggregate comes from permissive sources (MIT / Apache-2.0), attribution kept: an MSSP can redistribute it to its clients. Our maison queries (nearly half) are proprietary, under EULA (subscriber use). You know exactly what’s redistributable and what stays yours.
Every hunting query carries its ATT&CK tactic(s), derived from the tables it reads. You cover a tactic, you document your coverage, you feed a report, not just a list of queries.
Linux, macOS and Windows in one pack, each query tagged to its platform. A heterogeneous fleet covered without juggling three sources.
The three sources overlap: duplicates (same normalized SQL) are merged. You get one clean set, not three overlapping lists.
The pack is signed; you verify its integrity before every fleet deployment.
What is osquery again?
osquery exposes the operating system (processes, connections, scheduled tasks, extensions, users…) as a SQL database. You query your endpoints in SQL. It’s the open-source standard for endpoint visibility, used by SOC/IR teams and platforms like Fleet and Kolide.
Why validate on the schema, not osqueryd?
osquery tables are OS-specific: a macOS query (e.g. managed_policies) “fails” on a Linux runner even though the SQL is fine. Running osqueryd would therefore give false verdicts by platform. We validate against the official table catalog (the SQL parses + every table exists): it’s deterministic, platform-independent, and catches exactly the real defect, a non-existent table or a typo.
How do I use it?
The pack ships a normalized queries.json, an index.json and bundles/ by platform / tactic / category. Convert the bundle you want to the osquery pack format (JSON queries) or import it into Fleet. Deploy your platform’s bundle, schedule the hunting queries via osqueryd, send results to your SIEM. The CIS subset serves compliance audits.
What licenses, and can I resell / MSSP?
The pack is a proprietary subscription. The aggregated part comes from permissive open-source sources (MIT / Apache-2.0), attribution kept: it stays redistributable, MSSP use included. Our forged maison queries (nearly half the pack, converted from our Sigma detections and YARA signatures) are proprietary (c) CyberConsulting.fr, under EULA: use within your own security operations, not redistributable. You subscribe for that forge, the curation, the validation and the mapping, not for clonable queries.
Does it work with the ThreatClaw agent?
Yes, directly. The ThreatClaw agent already runs osquery on endpoints: the feed plugs in as a source of hunting queries, ATT&CK-mapped, with no extra tool. But the pack is standalone, it runs just as well with osqueryd/Fleet alone, no lock-in.
Ready to hunt across your endpoints?
Annual subscription. Instant key. Cancel anytime.