Adding security posture checks to schedule

[javuto]

Overview

A system that automatically ingests osquery result logs from scheduled queries prefixed with osctrl:posture: and stores them as per-node posture data, enabling security and compliance posture visibility across the fleet.

How it works

Operator configures posture queries in the environment's schedule config with names prefixed by osctrl:posture:. The prefix is configurable via --posture-query-prefix (default osctrl:posture:, empty disables the feature entirely).

osquery executes the queries on schedule and sends results back to osctrl via the standard /log endpoint as regular result logs.

osctrl-tls intercepts the result logs in the LogHandler goroutine. After normal log processing, it calls ingestPosture() which parses each result entry, checks if the query name starts with the configured prefix, and feeds matching results to the PostureManager.

PostureManager upserts the data into a node_posture table, keyed by (node_uuid, category). The category is extracted from the query name by stripping the prefix (e.g., osctrl:posture:packages_deb → packages_deb). Each record stores the row count, a summary (first 100 rows as JSON), the full snapshot (capped at 256KB), and timestamps.

API endpoint GET /api/v1/nodes/{env}/node/{uuid}/posture returns all posture categories for a node.

Frontend "Posture" tab on the Node Detail page shows each category as a collapsible card with the row count and last-updated time. Expanding a card shows the data rows in a compact table.