EDAMAME vs osquery
Go beyond endpoint telemetry
EDAMAME scores posture on every machine, ships user-approved fixes, and rolls audit evidence into EDAMAME Hub — no fleet manager, no query packs. osquery gives you the telemetry; EDAMAME gives you the posture.
How it works
From raw telemetry to managed posture
osquery hands you raw rows to deploy, schedule, store, and interpret. EDAMAME gives you the managed posture program — in three steps.
Deploy on the machines that matter
EDAMAME Security on developer, BYOD, and contractor laptops. Posture is scored out of the box — no query packs to author, no schema to maintain.
Inventory the fleet in Hub
EDAMAME Hub shows which workstations and runners are in, which are missing, and live posture scores — without standing up and operating a fleet manager.
Remediate, gate, and export
Users approve guided fixes on their own machine; gate GitHub, SSH, and VPN on posture; export SOC 2 / ISO 27001 evidence. The actions osquery can only observe.
Comparison
Osquery vs EDAMAME
osquery is a powerful telemetry primitive — and the foundation many tools, including Kolide and Fleet, are built on. EDAMAME delivers the managed program above it as a product: posture scoring, user-approved remediation, fleet evidence, and conditional access — nothing for you to assemble, host, or keep running.
What you need
osquery (self-operated)
EDAMAME
Posture answer
Raw SQL rows you interpret — you define what counts as compliant and maintain the query packs.
Posture scored out of the box on macOS, Windows, and Linux — against a public, NIST/CIS-based threat model, not rules you write yourself.
Remediation
osquery itself is read-only — remediation means adding a fleet manager (Kolide, Fleet) or your own scripts.
User-approved guided fixes in-app; no remote-control console.
Audit evidence
You build the storage, reporting, and history yourself.
Continuous SOC 2 / ISO 27001 posture history rolled up in Hub.
Access control
Not in scope — telemetry only.
Gate GitHub, SSH, and VPN on posture; conditional access from Hub.
Operating cost
Fleet manager, query packs, pipeline, and upkeep as fleets drift.
Lightweight agent + Hub. Nothing to host or maintain.
Privacy & device-owner autonomy
Runs with full admin/root — whoever operates it can query anything on any enrolled machine, with no consent boundary for the device owner.
Reporting-only and user-approved. No arbitrary querying, no remote wipe, no covert control — owners keep autonomy on BYOD and contractor laptops.
Visibility without taking over the machine
osquery runs with full admin on the host, so whoever operates it can query anything on the machine. EDAMAME is reporting-only and user-approved — it proves posture to the security team with no arbitrary querying, no remote wipe, and no covert control, so developers and contractors keep autonomy on their own devices.
Proof
EDAMAME proves posture on the machines you can't or shouldn't lock down — personal laptops, contractor devices, and developer workstations — with no MDM enrollment and no full-admin agent. Security gets continuous evidence; the device owner keeps their machine.
