Airbnb's 5 year osquery adventure
summary
Airbnb describes a five year osquery rollout that replaces dual agents by sending osquery results into AWS Kinesis and processing them with StreamAlert for real‑time alerts and actions. The deployment adds custom extensions (including an osquery‑driven firewall integration) and a homegrown MDM Director tied to microMDM to reconcile profiles and certificates. Roadmap items include Linux containers on Chrome OS for osquery, using osquery-derived device posture to update BeyondCorp/IAP tags, and overall emphasis on transparency, query minimization, and operational cost on endpoints.
AI-written summary · about
chapters (23)
- 0:00Intro
- 0:45Back in 2014
- 2:14Airbnb Information Security Team
- 3:04What we learned
- 4:08AWS Kinesis
- 5:26StreamAlert
- 6:24Infrastructure
- 6:57What is Always Query
- 7:18What does it mean to a user
- 8:19The reality
- 8:35User experience perception
- 9:10Traditional security tools
- 9:57Transparency
- 11:30WiFi
- 12:10Do I need this data
- 14:22Trail of Bits
- 15:34Whats Next
- 16:08Apple MDM
- 16:30Micro MDM
- 18:50Chrome OS
- 19:21Ansible
- 19:52Zero Trust
- 22:52Conclusion
related talks
40mBeyond Endpoint Security Using Osquery at Scale
46m2014.10.29 - Security@Scale - Mike Arpaia, Facebook
20mLeveraging Osquery for DFIR at Scale
19mSecuring the endpoint with open software
22mIntrospecting your machines with osquery
29mTurn On the Lights
16mA Thrilling Journey into Data-Driven Security Automation
19mOXO: Orchestrating Security Scans Like a Pro