04/26/2017, 4:37 PM
Hi @pleegor, I'm a co-founder of Kolide and I can provide a bit of perspective... osquery management tools such as those you mentioned can help extend the capabilities and ease the management of an osquery installation. Here are the major benefits we offer in Kolide right now. 1) Get a basic understanding of which hosts are running osquery, and their online status. With osquery by itself, you'd have to piece this sort of information together through your log aggregation system. 2) Live queries. Run osquery queries across your fleet instantly, and see aggregated results right in your web browser. This can be useful for hunting, incident response, or just iterating on queries that you intend to schedule. 3) Labels. Create dynamic groupings of hosts (by utilizing osquery queries), and target packs and live queries against these hosts. This can also be useful to create groupings of out of compliance hosts, for example. 4) Scheduling query packs. Update the queries in Kolide, and the osquery hosts will begin running them very soon after. Compare this with existing workflows: push changes to your configuration management system, and then manually (or probably also using whatever handles the configuration) restart the osquery agent on each host.