Ultra-lightweight, passive endpoint security & threat intelligence engine powered by Osquery, FastAPI, Vue 3, and LLM ReAct Intelligence.
Modern security tools are often bloated, active, and invasive. OSQ-Intel offers a lightweight, zero-disruption alternative designed for modern IT & security teams.
By pairing Osquery's passive endpoint telemetry with LLM ReAct agents and multi-source threat intelligence (NVD, CISA KEV, GHSA, OSV.dev), OSQ-Intel automatically translates newly disclosed vulnerabilities (CVEs) into targeted, zero-hallucination Osquery SQL telemetry and actionable remediation scripts—with Human-in-the-Loop safety built-in.
+-----------------------------------------+
| Vue 3 Management UI |
+--------------------+--------------------+
|
v (HTTP / WebSockets)
+-----------------------------------+-----------------------------------+
| OSQ-Intel Server |
| |
| +---------------------+ +--------------------+ +----------------+ |
| | Multi-Source CVE | | Schema RAG & LLM | | Fleet & Task | |
| | Ingestion Engine | | ReAct Analyst | | Dispatcher | |
| +---------------------+ +--------------------+ +----------------+ |
+-----------------------------------+-----------------------------------+
|
v (Secure WebSocket / JSON)
+--------------------+--------------------+
| OSQ-Intel Endpoint Agent |
| (Linux / Windows Daemon) |
| |
| +---------------------------------+ |
| | Osquery Runner (osqueryi --json) | |
| +---------------------------------+ |
| | Local Offline Buffer (SQLite) | |
| +---------------------------------+ |
+-----------------------------------------+
- Zero-Disruption Passive Scanning: Relies on Osquery native OS state introspection (
osqueryi --json). - Multi-Source CVE Threat Feed: Aggregates NVD v2, CISA Known Exploited Vulnerabilities (KEV), ExploitDB, GitHub Security Advisories (GHSA), and OSV.dev REST.
- Grounded AI Engine (Schema RAG): Generates syntactically guaranteed Osquery SQL using Osquery 5.11.0 schema definitions. Zero hallucinations.
- Human-in-the-Loop Remediation: Automated fix scripts (Bash/PowerShell) require explicit operator authorization via single-use execution tokens.
- Decoupled Autonomous Architecture: Server (
server/) and Endpoint Agents (agent/) operate independently over robust WebSocket channels with auto-reconnection and heartbeat.
- Python 3.10+
- Node.js 18+ (for Web UI)
- Osquery (
osqueryi) installed on target host/agent
git clone https://github.com/mattiavivi/osq-intel.git
cd osq-intel
# Copy environment template
cp .env.example .envStart the full stack (FastAPI Server, Vue 3 Frontend, and Local Endpoint Agent):
./run.sh startCheck status or stop:
./run.sh status
./run.sh stopRun the automated test suite before committing or deploying:
/home/sysadmin/project/.venv/bin/python3 -m unittest discover -s tests- Phase 1: Core Decoupled Agent/Server Engine & Offline SQLite Buffer
- Phase 2: Fleet Telemetry, Web UI, and Query Scheduler
- Phase 3: Multi-Source Threat Intelligence & LLM ReAct Agent
- Phase 4: Human-in-the-Loop Remediation & Execution Token Security
- Phase 5 (Enterprise): Multi-Tenant SaaS, RBAC, Automated Patch Rollback & Compliance Dashboards (CIS/NIST)
Distributed under the GNU Affero General Public License v3.0 (AGPL-3.0). See LICENSE for more information.