31–36 of 36 posts
I'd like something that integrates canned DTrace/eBPF scripts, along with authorization (some canned scripts might leak sensitive data). Really, a bit of an idempotent, extensible, remote OS observability protocol.
[0] https://en.wikipedia.org/wiki/Windows_Management_Instrumenta...
Something like this already exists for Windows[1] There is apparently a standard[2] for exposing operating system objects into a schema that can have a standard query. I don't think I've ever seen any common monitoring projects built using WMI/WBEM at their core ... [1]: https://docs.microsoft.com/en-us/windows/win32/wmisdk/about-... [2]: https://stackoverflow.com/questions/921617/is-there-somethin...
afaik one of the main motivations that led to start osquery project was precisely to have a cross platform tool to allow collecting much needed information from all your hosts in an enterprise setting
We have been a big part of the Osquery community for a while and we think it's an awesome project that can be used to get an insane level of visibility across your fleet. We also think in the context of rolling this out to end-users, companies need to really consider the privacy implications of the data Osquery is capable of collecting.
To that end, we soft-launched a product in May that helps fast growing tech companies use tools like Osquery to implement something called User Focused Security. User Focused Security involves treating employees like adults and understanding the context in which they work before rolling out a security strategy.
We want to be the best choice for organizations that want to get serious about the security of their laptops but don't want to lock-down devices, violate their user's privacy, or hurt their internal culture with opaque surveillance.
The three values that we use to build our software:
1. User Education over Enforcement
2. Trust through Transparency
3. Quality conclusions over Quantity of data
We use Osquery because it helps us fulfill that second value by giving end-users visibility into what is running on their device.
If your team uses Slack and want to see our approach you should check us out at https://kolide.com
Kolide's CEO here! ( https://kolide.com ) We have been a big part of the Osquery community for a while and we think it's an awesome project that can be used to get an insane level of visibility across your fleet. We also think in the context of rolling this out to end-users, companies need to really consider the privacy implications of the data Osquery is capable of collecting. To that end, we soft-launched a product…
Earlier quoted context omitted.
Facebook has since transfered the project to the Linux Foundation, and the group behind osql is largely the same group of maintainers on the current osquery. https://www.linuxfoundation.org/press-release/2019/06/the-li...
This is great news! Thank goodness that something like the Linux Foundation exists; this is a perfect piece of software for it to absorb.
Our security team uses this, we’re about 1500 employees. However, I believe they opted to use a fork over this linked version, citing (IIRC) that Facebook’s roadmap for this project was a little bit too unpredictable, and that they weren’t responsive to PRs and community requests. I think we went with https://github.com/osql/osql . It’s installed on every laptop (chrome books and MacBooks), and I believe on every EC2…
Snowalert running on Snowflake is a reasonable aggregator/alerting solution for anyone looking to do this. https://community.snowflake.com/s/article/Snowflake-Using-Sn...