Introspecting your machines with osquery
summary
osquery exposes system state as SQLite tables so you can run SQL against hardware, packages, processes, logs and network connections; the project has 270+ SQL tables and shows a live demo hashing small open files with a single query. It supports evented timestamped logs, file carving (note file carving requires a server and explicit enable), Docker inspection (expects /var/run/docker.sock), and an extension API over Apache Thrift. Windows support exists but is still hit or miss and a worker/watchdog kills expensive queries.
AI-written summary · about
chapters (6)
- 0:00Introduction to osquery
- 2:23What is osquery and demo
- 7:06Core goals and design
- 10:19Tables and schemas
- 17:02Advanced features and extensions
- 21:03Threat hunting basics
related talks
46m2014.10.29 - Security@Scale - Mike Arpaia, Facebook
27mThou Shalt Query: Compliance Ideas with Osquery
20mLeveraging Osquery for DFIR at Scale
22mUsing osquery as an SSH replacement for remote host investigation
19mSecuring the endpoint with open software
29mThe osquery Agent. Performance Tuning @Scale
40mBeyond Endpoint Security Using Osquery at Scale
21mosquery from a Cloud-Native and Zero Trust Perspective