afaik the only currently supported OSS project that does alerting is Zentral (https://github.com/zentralopensource/zentral/wiki). It's pretty mac focused. We also have OSS Kolide Fleet (https://github.com/kolide/fleet) which does osquery management, but leaves it up to you to figure out what you want to do with your logging pipeline and alerting). Our paid cloud product has rich alerting features (kolide.com)