Scaling osquery with pure open source tech
summary
Explains how the osquery remote API maps to three concrete handlers—enroll, config and log—plus distributed read/write and optional file‑carving endpoints, and shows an open‑source TLS endpoint (osctrl) that has run successfully on several thousand hosts. Gives the actual scaling math: pick the highest interval, divide by each interval and sum to estimate requests (example yields ~0.015 req/s per node or ~15 rps for 5,000 nodes). Describes modular components (TLS endpoint, admin/API) and deployment caveats like peaks, re‑enroll behavior and accelerated mode.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:38Osquery fundamentals
- 3:42Managing fleet logs
- 5:36Configuration strategies
- 7:01Remote API implementation
- 9:21Building API handlers
- 16:52Client-side configuration
- 18:58Scaling and infrastructure
- 26:49Osquery control example
- 28:53Lessons learned
related talks
40mBeyond Endpoint Security Using Osquery at Scale
20mLeveraging Osquery for DFIR at Scale
46m2014.10.29 - Security@Scale - Mike Arpaia, Facebook
25mServerless Osquery Backend and Big Data Exploration
19mSecuring the endpoint with open software
22mIntrospecting your machines with osquery
13mSecuring the Data Frontier: Real-World Strategies With OpenSearch
13mOpenSearch at Atlassian Scale