Built on osquery

osquery API
with webhooks

Schedule SQL queries across your fleet, get webhook notifications with results. Build security automation without polling.

curl -sSL https://hyprwatch.cloud/install/ORG_xxx | sudo sh
Shadow Agent v0.1.0
Connecting to hyprwatch.cloud...
Enrolled successfully!
Starting osqueryd...
Host online. Ready for queries.

API-first fleet management

Query your endpoints, schedule compliance checks, get webhooks when things change.

REST API

Execute queries, manage hosts, and retrieve results programmatically. Full OpenAPI spec with Swagger UI.

Webhooks

Get notified when hosts enroll, come online, go offline, or when scheduled queries complete. HMAC-signed.

Scheduled Queries

Run queries on a schedule. Get webhook notifications with results. Perfect for compliance monitoring.

One-line Install

Deploy agents with curl. Auto-installs osquery, configures everything, connects to your fleet.

osquery is Facebook's open-source tool that lets you query your operating system like a database. Hyprwatch gives you an API to run those queries across thousands of machines and get webhooks when things change.

Security automation made simple

Schedule a query, get a webhook when it runs. Build alerting pipelines without polling.

1

Schedule a compliance query

POST /api/v1/queries
{"name": "unauthorized_ssh_keys",
 "sql": "SELECT * FROM authorized_keys WHERE NOT key LIKE '%@company.com'",
 "schedule_interval": 3600}
2

Set up a webhook

POST /api/v1/webhooks
{"url": "https://your-app.com/alert",
 "events": ["query.completed"]}
3

Get notified with results

Every hour, your webhook receives query results. Alert on anomalies, pipe to Slack, trigger remediation.

Webhook payload:
{
  "event": "query.completed",
  "data": {
    "query_name": "unauthorized_ssh_keys",
    "host_id": "h_abc123",
    "hostname": "prod-server-01",
    "row_count": 2,
    "rows": [
      {"key": "ssh-rsa AAAA... unknown@laptop"},
      {"key": "ssh-rsa AAAA... temp@external"}
    ]
  }
}

Unauthorized keys found? Alert fires. Zero keys? Silent success.

Get started in minutes

1

Get API key

Sign up, get your API key and enrollment token.

2

Install agent

One curl command. Installs osquery, connects to fleet.

3

Query & automate

Run queries via API. Set up webhooks for alerts.

Ready to build?

Get your API key and start querying your fleet in minutes.