An osquery fleet manager for remote configuration, distributed queries, and alerting across devices.
Doorman is an osquery fleet manager that allows administrators to remotely configure and monitor a fleet of devices running osquery. It provides tools for dynamic configuration via tags, distributed query execution, and alerting based on custom rules, centralizing endpoint visibility and security management.
System administrators, security engineers, and DevOps teams responsible for monitoring and securing fleets of servers, workstations, or IoT devices using osquery.
Doorman offers a self-hosted, open-source alternative for managing osquery at scale, with flexible tag-based configuration, extensible alerting, and support for various authentication methods, giving teams full control over their endpoint monitoring infrastructure.
an osquery fleet manager
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Dynamically assigns osquery packs, queries, and file integrity monitoring paths using tags, allowing flexible and scalable management across nodes without manual per-node updates.
Enables ad-hoc query execution across the fleet with real-time status tracking, as shown in the distributed queries screenshots, providing immediate visibility and response capabilities.
Supports custom rules with boolean logic and multiple alerting plugins (PagerDuty, email, Sentry, logs), with the README highlighting the ability to build complex rule sets for security events.
Offers no auth, local username/password, LDAP, or Google OAuth, catering to diverse security needs, though local auth requires manual user management via scripts.
For local 'doorman' authentication, the README admits that user registration and password resets must be handled via the manage.py script, lacking a web interface for self-service.
Requires configuring PostgreSQL, Redis, SSL certificates, and front-end dependencies via bower (which is deprecated), making deployment time-consuming and error-prone for non-experts.
Default alerting plugins are restricted to PagerDuty, email, Sentry, and logs; custom development is needed for other systems, which may not suit teams with diverse toolchains.