Osquery

#1

Post by duck » Mon, May 15, 2017, 8:02 PM UTC

Osquery
osquery.io

Re: Osquery

#2

Post by kbd » Tue, May 16, 2017, 1:11 AM UTC

Posted because it came up in the discussion of FSQL:

https://news.ycombinator.com/item?id=14343967

Previous discussions:

Release: https://news.ycombinator.com/item?id=8528460

Windows release: https://news.ycombinator.com/item?id=12600790

(Links courtesy of https://news.ycombinator.com/item?id=14344549)

Personally upvoted because it's news to me that it supports Windows now, and because it still appears to be very actively developed despite existing for years now.

Re: Osquery

#3

Post by dduarte » Tue, May 16, 2017, 1:51 AM UTC

Can it be used to find Windows machines without MS17-010 installed? :)

Re: Osquery

#4

Post by jeremymcanally » Tue, May 16, 2017, 2:32 AM UTC

dduarte wrote: post #3

Can it be used to find Windows machines without MS17-010 installed? :)

Definitely. And you could write queries for the various indicators/files/etc., too (or use the built in YARA support and grab the rules from US-CERT).

I just started working at Kolide (http://kolide.com) a couple weeks ago where we're building a whole product on top of osquery. I'm constantly surprised by "can it do (x)" and the answer is almost always yes. It's pretty solid!

Re: Osquery

#5

Post by lmeyerov » Tue, May 16, 2017, 4:43 AM UTC

If you're in a security team adding this to your stack, we're building a visual playbook & pivoting system, and have been wanting to experiment with scenarios that include an osquery connector. Can share more @ info@graphistry.com , would love to explore!

Re: Osquery

#6

Post by burdzwastaken » Tue, May 16, 2017, 4:52 AM UTC

cannot upvote this enough! seriously great open source project. I have been able to use it in large scale cross-platform deployments with great success.

Re: Osquery

#7

Post by onida » Tue, May 16, 2017, 4:55 AM UTC

Outside of facebook, what's the largest install base of osquery?

Re: Osquery

#8

Post by josteink » Tue, May 16, 2017, 5:27 AM UTC

I realize WMI[1] is a Windows-thing only, but if you're already on the Windows-platform, WMI comes shipped out of the box and has been for probably a decade or more, and is overall very well supported.

It has its quirks, but there's practically no part of the system you shouldn't be able to get information about using WQL[2].

[1] https://msdn.microsoft.com/en-us/library/ms186146(vs.80).asp...

[2] https://en.m.wikipedia.org/wiki/WQL

Re: Osquery

#9

Post by kossmoboleat » Tue, May 16, 2017, 6:39 AM UTC

I've worked on something similar except that we used a stream database. Today you might use RethinkDB or something similar.

The osquery events seem to solve these kind of monitoring/alerting problems. But I didn't find easily find their documentation.

Re: Osquery

#10

Post by nthcolumn » Tue, May 16, 2017, 7:31 AM UTC

kbd wrote: post #2

Posted because it came up in the discussion of FSQL: https://news.ycombinator.com/item?id=14343967 Previous discussions: Release: https://news.ycombinator.com/item?id=8528460 Windows release: https://news.ycombinator.com/item?id=12600790 (Links courtesy of https://news.ycombinator.com/item?id=14344549 ) Personally upvoted because it's news to me that it supports Windows now, and because it still appears to be very ac…

I only heard about this yesterday on that thread. And by facebook? I really should pay more attention to what they are doing over there... FSQL is pretty cool too and surprisingly fast.