#898 Adding security posture checks to schedule Pull request opened by javuto Overview A system that automatically ingests osquery result logs from scheduled queries prefixed with osctrlposture and stores them as per-node posture data, enabling security and compliance posture visibility across the fleet. How it works Operator configures posture queries in the environment's schedule config with names prefixed by osctrlposture. The prefix is configurable via --posture-query-prefix (default osctrlposture, empty disables the feature entirely). osquery executes the queries on schedule and sends results back to osctrl via the standard /log endpoint as regular result logs. osctrl-tls intercepts the result logs in the LogHandler goroutine. After normal log processing, it calls ingestPosture() which parses each result entry, checks if the query name starts with the configured prefix, and feeds matching results to the PostureManager. PostureManager upserts the data into a node_posture table, keyed by (node_uuid, category). The category is extracted from the query name by stripping the prefix (e.g., osctrlposturepackages_deb → packages_deb). Each record stores the row count, a summary (first 100 rows as JSON), the full snapshot (capped at 256KB), and timestamps. API endpoint GET

/api/v1/nodes/{env}/node/{uuid}/posture

returns all posture categories for a node. Frontend "Posture" tab on the Node Detail page shows each category as a collapsible card with the row count and last-updated time. Expanding a card shows the data rows in a compact table. jmpsec/osctrl