Open-source Tanium alternatives

osquery is an instrumentation, monitoring and analytics framework that lets you ask questions about an operating system using SQL. It makes the machine look like a high-performance relational database, so instead of writing scripts for each platform you query tables describing things like processes, kernel modules, network sockets, browser extensions, hardware events and file hashes.

It works on Linux, macOS and Windows. New tables are added through a simple plugin and extensions API, and a public schema reference documents the available tables. The README illustrates its expressiveness with sample queries such as listing users or finding processes whose binaries were deleted from disk. Resources include documentation on ReadTheDocs, downloads, Stack Overflow and a Slack community, and topics tag it for security, intrusion detection and monitoring.

osquery is written in C++ and its license is listed as 'Other' on GitHub, so check the repository for the exact terms. It runs locally on each endpoint, and organizations typically deploy it across a fleet and collect results with their own tooling. It suits security teams, IT administrators and detection engineers who want consistent endpoint visibility.

Wazuh is a free and open-source platform for threat prevention, detection and response. It protects workloads across on-premises, virtualized, containerized and cloud environments and combines XDR and SIEM functions in one product. The code is written mainly in C++.

The solution consists of an endpoint security agent installed on monitored systems and a management server that collects and analyzes the agents' data. It is integrated with the Wazuh Indexer, which offers a search engine and visualization for navigating security alerts. Agents scan for malware, rootkits and suspicious anomalies, read system and application logs, and monitor files for changes to content, permissions, ownership and attributes.

Rule-based analysis of collected logs, including data received from network devices through syslog, helps surface misconfigurations, policy violations and attempted or successful attacks. Repository topics also cover vulnerability detection, configuration assessment, incident response and compliance such as PCI DSS. The repository lists its license as 'Other', so review the license files for the exact terms.

Fleet is an open-source platform for IT and security teams that manage large numbers of computers. It gives a single system to secure and maintain devices over the air, covering mobile device management, patching, software deployment and verification across all the operating systems an organization uses.

It gathers data and events straight from each device's operating system using osquery, and can report on hundreds of device attributes. It ships with CIS benchmarks for macOS and Windows. Platforms include Linux, macOS, Windows, Chromebooks, iOS and Android, as well as cloud and container environments. Fleet is built for infrastructure as code, so it can be managed with GitOps, a graphical interface, a REST API, webhook events or the fleetctl command-line tool.

Fleet is written in Go. The repository lists its licence as other, so check the project for the exact terms of its open-source and commercial components. Documentation, a demo and the option to talk to maintainers are linked from the README.