I’m working on https://checkpost.dev, a lightweight and easy-to-use osquery manager. It is open source, easy to self-host, and ships as a single binary. It only requires osquery to be installed on the endpoints. Checkpost is readonly and doesn't make any changes on the enrolled hosts.

It can run adhoc or scheduled queries and send the results to ClickHouse, or store them locally in Parquet files and use DuckDB to browse the results. It can also initiate YARA scans and collect the results. It also supports policy evaluation and alerting.