No vendor sales call. No license keys. git clone, docker compose up, and you have a self-hosted endpoint visibility platform on your own iron — running on hardware you control, with data that never leaves your network.
Project Mimir is a self-hosted endpoint visibility platform built on top of osquery. The server is a single Go binary you run in Docker. The agent is a small static binary that runs on every endpoint and answers SQL questions about that machine — installed software, listening ports, logged-in users, file hashes, anything osquery exposes as a table. Your security team gets a live dashboard, ad-hoc query, IOC matching, and SIEM webhooks. You keep the data.
One Go binary + PostgreSQL, run via docker compose. Hosts the React dashboard, REST API for humans + automation, and the gRPC endpoint that agents stream to.
Architecture →Static binary on each endpoint. Bundles osquery, runs scheduled packs, holds a persistent gRPC stream to the server, buffers locally if the server's down. Linux, macOS, Windows.
Agent docs →Tiny admin tool that lives on the server. Generates enrollment secrets, lists and revokes them, and surfaces server state. Most day-to-day work happens in the dashboard, not here.
CLI reference →If you have Docker on a Linux box you can ping from your endpoints, you're ready.
Three steps: bring the server up, generate a secret, install the agent on a host. We'll keep going to a real query at the end.
Clone the repo, drop into the deploy directory, set a postgres password, and let docker compose do the rest. The compose file pulls Project Mimir, Postgres, and nginx and wires them up.
Open http://localhost when it's done — a setup wizard will walk you through creating the admin account.
Each agent enrolls with a one-time secret. Agents authenticate via mTLS after that — the secret only grants the right to get a client cert.
The plaintext is shown once. Project Mimir bcrypt-hashes it on the server. Lost it? Generate a new one.
mimir-cli referencePick the OS, run one command. The installer drops the binary, registers a service (systemd / launchd / Windows SCM), and the agent enrolls within 60 seconds. It'll show up in the dashboard automatically.
For Windows fleets, the same MSI also accepts msiexec /qn properties for Intune and SCCM — see deployment.md for MDM packaging.
Open the dashboard, click Queries, paste an osquery SQL statement, hit run. Results stream back in real time over gRPC. Save anything useful into a Pack and it runs on a schedule across every host.
No agents online yet? You can spin up mimir-mockfleet — 200 deterministic virtual hosts for QA. See docs/qa/mockfleet.md.
You don't need to read every doc to be productive — but these five concepts thread through the dashboard, the API, and the runbooks.
A YAML bundle of osquery queries that run on a schedule across all agents. Project Mimir ships with default packs (system-info, installed-software, network-connections, security-posture). You can upload your own from the Settings UI — no restart.
A file hash, filename, file path, or Windows registry key you want to hunt for across the fleet. Drop one in and Project Mimir matches it against every endpoint every 15 minutes — and back-scans up to 90 days of history when you add it.
phase4-ioc-hunting.md →The unified /alerts page is the daily triage view. One ranked feed across IOC hits, tamper events, compliance violations, fleet changes, and host-state transitions. Keyboard-first: j/k to walk, A to ack, / to search.
Each agent's first contact with the server. The agent sends the bcrypt-checked enrollment secret, the server issues a unique ECDSA P-256 client certificate, and from then on every connection is mTLS. Decommissioned hosts cannot re-enroll without an admin.
enrollment & machine-id →All canonical docs live in the GitHub repo. They version with the code, so what you read always matches what you're running.
/alerts page — categories, saved views, keyboard triage, accessibility.SELECT from. Project Mimir runs against this exact schema.4433 (gRPC) and 8080 (enrollment HTTPS). If your server is on the corp network, agents stay on the corp network. The agent buffers results locally in SQLite when the server is unreachable and replays them when the connection comes back.SERVER_ADDR, ENROLL_API_ADDR, and ENROLL_SECRET as msiexec /qn properties. Detection rules, per-collection secrets, and upgrade behavior are all in docs/deployment.md.MIMIR_SECRET_KEY sharing requirement for TAXII — is in deployment.md § Multi-Instance.make dev-sso-up. See docs/fakeidp.md.mimir-server --version), the agent version (mimir-agent --version), and the relevant log lines. If it's a security issue, mark it accordingly — please don't post exploits in public threads.Want to see the dashboard, the globe, and the IOC matcher with real fleet data before you commit? The instant demo runs entirely in your browser with mockfleet's 200 simulated hosts.