+========================================================================+

CITADEL

// hardened osquery fleet manager · fork of Kolide Fleet

+========================================================================+

v0.1 · [ACTIVE] · Go · React · MySQL · Redis · Helm

A maintained, hardened fork of Kolide Fleet, the open-source osquery fleet manager, brought forward off an upstream that stopped moving. Go server and React dashboard for live queries across enrolled hosts, scheduled query packs, and host inventory — plus a curated pack library, a host-native network scanner that finds unenrolled devices on the LAN, and signed agent packages.

> Live queries and scheduled packs against enrolled hosts, driven from the dashboard or the citadelctl CLI
> Curated osquery packs for macOS hardening and code integrity, endpoint protection, file integrity, and Linux inventory
> A separate network scanner surfaces hosts on the LAN that are not enrolled yet
> Toolchain and base images kept current; agent .deb and .rpm built and published from a tag
> Internal deploy — no public domain

----------------------------------------------------------------------------------------

> screens

The Citadel fleet dashboard: cards for hosts online, failing checks, packs reporting and result rows in the last 24 hours; a fleet roster with offline hosts first; a hardening donut of failing, unreported and passing checks; seven-day charts of result volume and hosts reporting; and a disk-capacity panel. — fleet dashboard · result volume, quiet hosts, disk headroom and hardening posture over 24 hours · example fleet

The Citadel hosts view: a table of enrolled hosts with status, hostname, platform, operating system, osquery version, address, uptime and last-seen time, beside a scope panel of online, offline and missing counts and the built-in platform labels. — enrolled hosts · status, platform, osquery version and last check-in per host · example fleet

Citadel host detail for one macOS host: a posture strip of System Integrity Protection, Gatekeeper, FileVault and application-firewall checks, each with the query that reported it; enrolment and collection details; and a pack-freshness table of the packs targeting the host with intervals, last result and row counts. — one host · every figure is a result the agent reported, with when it was refreshed · example fleet

> what it does

CITADEL is an osquery fleet manager: enrol a host, and you can ask it questions in SQL — what is installed, what is listening, which launch agents exist, whether the disk is encrypted — either live across the whole fleet or on a schedule. A Go server holds the fleet state and the results; a React dashboard and the citadelctl CLI are the two ways in.

It is a fork of Kolide Fleet, the most widely deployed open-source fleet manager of its generation, which stopped being maintained in that form. The fork exists to keep it alive and current: dependencies and base images moved off end-of-life, the toolchain pinned and checked, agent packages built and published from a tag, and a Helm chart for deploying the server.

> what’s inside

>Live queries across enrolled hosts, plus scheduled query packs with result retention.
>A curated pack library: macOS hardening, code integrity and identity, endpoint protection, file integrity, Linux inventory and system state.
>A separate network scanner that finds hosts on the LAN which are not enrolled yet.
>citadelctl for everything the dashboard does, against a declarative YAML config.
>Agent .deb and .rpm packages and a Helm chart, both built in CI from a tag.

> why it exists

Knowing what is actually running on the machines you own is the unglamorous foundation under every other security control, and the open-source tool that did it best was left where it stood. A fork is cheaper than a replacement, as long as somebody keeps doing the maintenance nobody enjoys.

Internal deploy — no public domain. Upstream Kolide Fleet is licensed MIT.