How Stripe is actioning the osquery API at scale
summary
Stripe codifies osquery detections into a Git-backed YAML repo with linting and Jenkins deployment, converts query results into pandas dataframes via Python libraries, and stores endpoint telemetry in S3 then forwards to Splunk and an UpTicks streaming engine. Detections run as JavaScript in UpTicks (most rules) or SQL, with an UpTicks event validator that replays SQL results against JS logic. Built hundreds of rules, automated PR validation, and measures 0.7s execution latency and notebooks-as-platform for repeatable investigations.
AI-written summary · about
chapters (8)
- 0:00Introduction to Osquery
- 3:21Developing a detection framework
- 5:40Data science and notebooks
- 8:38Abstracting API access
- 12:28Continuous hunting and baselining
- 15:47Detection methodology
- 20:09Engine diversity and scaling
- 23:33Automated linting and validation
related talks
43mObserving from Incidents
40mBeyond Endpoint Security Using Osquery at Scale
15mGrowing
31mObservability in strikethrough action! /strikethrough the wild
14mImplementing AI-Powered O11y with Splunk
19mSecuring the endpoint with open software
20mLeveraging Osquery for DFIR at Scale
22mIntrospecting your machines with osquery