Project Mimir is a self-hosted endpoint visibility platform built on osquery. Enroll thousands of hosts, query your fleet in SQL, and ship IOC alerts to your SIEM — all in 90 seconds.
The point of an EDR is to know what's happening on every endpoint. The cost, with most vendors, is shipping that knowledge to a third party. Project Mimir doesn't make that trade. Modern crypto, mutual auth on every connection, signed releases, and zero outbound telemetry — designed by a CISO who cares about security
Every agent ↔ server connection is mutually authenticated TLS 1.3. Each agent gets a unique ECDSA P-256 client cert at enrollment — no shared secrets at rest, no API keys to rotate, no bearer tokens to leak.
Enrollment secrets are bcrypt-hashed on the server, plaintext shown exactly once. They authorize one thing only: getting a client cert. Decommissioned hosts can't re-enroll without an admin.
Agent binaries are Ed25519-signed; agents verify before applying any update and refuse downgrades. A bad SHA can be blacklisted across the fleet and rollout frozen to 0% in one runbook step.
OIDC and SAML 2.0 with JIT provisioning and group-based admin elevation. There's a self-contained fake IdP for local testing — no Okta sandbox required to validate your assertions.
Project Mimir focuses on the unsexy parts of EDR — enrollment, transport, query distribution, IOC matching, host inventory — and stays out of your way for everything else.
Every enrolled host sends a heartbeat every 30s. Online / stale / offline state, plus full system facts in one queryable table.
Subscribe to threat feeds or paste your own indicators. Project Mimir matches process, file, and network events as they arrive — no batch lag.
Type a query, hit run, watch results stream back from thousands of hosts in under three seconds. Save useful queries to a Pack.
Catch the host running osquery 5.11.0 when everyone else is on 5.13.1. Same for kernel, packages, configs — anything queryable.
CIS, PCI, HIPAA — bundled query packs that map to the controls your auditor cares about. Schedule, dashboard, export.
Project Mimir is a sensor, not a destination. Forward alerts to Splunk, Elastic, Datadog, or any HTTPS endpoint with a JSON payload.
Heterogeneous fleets are reality. The dev laptops are Macs, the production servers are Linux, the corporate desktops are Windows, and somewhere in the rack room there's a FreeBSD storage node nobody talks about. Project Mimir's agent ships for all of them — same protocol, same dashboard, same SQL.
The point of an IOC is to find compromise wherever it lives. Project Mimir matches indicators against live events as they arrive, and back-fills against the last 30 days of fleet history the moment you add a new one. Drop in a hash, paste a STIX/TAXII feed, or write your own osquery SQL — same engine, same alert surface.
File hashes, filenames, file paths, Windows registry keys, network IOCs. Manual paste, CSV bulk import, or pull from a STIX/TAXII feed on a schedule.
Every agent matches new events as they happen — process, file, network. Server back-fills new IOCs against 30 days of historical events the moment you save them.
IOC hits land in the unified /alerts feed alongside tamper, compliance, and drift events. Keyboard-first triage. Forward via webhook to your SIEM.