Can anyone shed some light on how exactly Osquery can be used to leverage checking, for example, of vulnerabilities? I wasn't able to gather information on how it exactly communicates with the rest of the infrastructure. Am I correct to understand that I can set up a single host that has Osquery installed and it can go out and automatically query a heterogeneous set of other hosts based on pre-existing configuration files, given that (I assume) some set of ports are open?
Osquery
11–20 of 29 posts
Re: Osquery
#12Can anyone shed some light on how exactly Osquery can be used to leverage checking, for example, of vulnerabilities? I wasn't able to gather information on how it exactly communicates with the rest of the infrastructure. Am I correct to understand that I can set up a single host that has Osquery installed and it can go out and automatically query a heterogeneous set of other hosts based on pre-existing configuration…
Indeed -- Osquery, and the commercial precursor Tanium and the native Microsoft equivalents, can help when you've identified one incident and want to find active repeats. Ex: "I just cleaned evil.exe from this box, are any other hosts running the same process? What other processes do they have in common?". I've seen hunting use cases as well.
Your example is why we're building our visual playbook system. In this case, query your network scanner for open ports, and then feed the identified hosts into more targeted osquery calls.
Re: Osquery
#13like
Re: Osquery
#14Useless out of the box:
"If there are no USB devices added or removed to the laptop, this query would never log a result again. The query would still run every 60 seconds but the results would match the previous run and thus no state change would be detected. If a USB memory stick was inserted and left in the laptop for 60 seconds the daemon would log"
So if you unplug your evil USB earlier, this won't tell you.
I wonder if they've heard of udev.
Re: Osquery
#15Can anyone shed some light on how exactly Osquery can be used to leverage checking, for example, of vulnerabilities? I wasn't able to gather information on how it exactly communicates with the rest of the infrastructure. Am I correct to understand that I can set up a single host that has Osquery installed and it can go out and automatically query a heterogeneous set of other hosts based on pre-existing configuration…
Indeed -- Osquery, and the commercial precursor Tanium and the native Microsoft equivalents, can help when you've identified one incident and want to find active repeats. Ex: "I just cleaned evil.exe from this box, are any other hosts running the same process? What other processes do they have in common?". I've seen hunting use cases as well. Your example is why we're building our visual playbook system. In this case…
Thank you for the reply; however, I am still having a hard time understanding how exactly Osquery works under the hood. How does it communicate with other hosts? With what does it query for information once it reaches a remote node? What kind of overhead does it have in terms of network transfer when querying? Maybe I am completely off base and am mistaking how this works... Is Osquery set up on every individual host and I query for that information remotely using whatever tools I have at my disposal?
Re: Osquery
#16Earlier quoted context omitted.
Indeed -- Osquery, and the commercial precursor Tanium and the native Microsoft equivalents, can help when you've identified one incident and want to find active repeats. Ex: "I just cleaned evil.exe from this box, are any other hosts running the same process? What other processes do they have in common?". I've seen hunting use cases as well. Your example is why we're building our visual playbook system. In this case…
Thank you for the reply; however, I am still having a hard time understanding how exactly Osquery works under the hood. How does it communicate with other hosts? With what does it query for information once it reaches a remote node? What kind of overhead does it have in terms of network transfer when querying? Maybe I am completely off base and am mistaking how this works... Is Osquery set up on every individual host…
You can configure osquery to execute periodic queries (scheduled queries) of all kinds: computing md5 of your binaries and other files, taking a snapshot of sockets/connections per process, and so on.
By default, osquery uses glog, which means it'll output the results to a local file that you can ship anywhere you want. There's also logging plugins to help you push the results of scheduled queries to other systems.
Once you have that data flowing through your pipelines you can start doing security/anomaly detection on things.
Re: Osquery
#17If you're in a security team adding this to your stack, we're building a visual playbook & pivoting system, and have been wanting to experiment with scenarios that include an osquery connector. Can share more @ info@graphistry.com , would love to explore!
What is a "visual playbook and pivoting system"?
Re: Osquery
#18Useless out of the box: "If there are no USB devices added or removed to the laptop, this query would never log a result again. The query would still run every 60 seconds but the results would match the previous run and thus no state change would be detected. If a USB memory stick was inserted and left in the laptop for 60 seconds the daemon would log" So if you unplug your evil USB earlier, this won't tell you. I wo…
Oh please. It may be useless out of the box at detecting evil USB devices, but to accuse it of being outright useless is ridiculous.
I'm sure it was sarcastic snark, but of course they have heard of udev: https://github.com/facebook/osquery/search?q=udev.
Re: Osquery
#19Not directly related to Osquery, but we're using Tanium to run queries against ~180,000 endpoints and we get good results back in about a minute.
Re: Osquery
#20I realize WMI[1] is a Windows-thing only, but if you're already on the Windows-platform, WMI comes shipped out of the box and has been for probably a decade or more, and is overall very well supported. It has its quirks, but there's practically no part of the system you shouldn't be able to get information about using WQL[2]. [1] https://msdn.microsoft.com/en-us/library/ms186146(vs.80).asp... [2] https://en.m.wikiped…
The nice thing osquery can have is disconnecting what's currently turned on and connected this second from what records you're getting back.
OSquery can pump results into a DB that you look through, WMI I've got to check for myself what's turned on, did it all report etc.
A driver for wmi in osquery would be a great addition.