Thou Shalt Query: Compliance Ideas with Osquery
summary
Shows six concrete osquery techniques: run Wi-Fi_survey across the 10 closest Macs per AP to quarterly-scan Wi‑Fi, use the block_device+mount join to target USB mounts and run yara_events for DLP (found an SSN in an RTF on a SanDisk 250 in testing), wire up file integrity via fsevents/notify, parse Apache/nginx configs with osquery+augeas to verify NIST cipher settings, and collect certificate metadata with curl_certificates to alert on expirations.
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:48Thou Shalt Compliance
- 2:27Thou Shall Keep Thy Systems Patched
- 3:39Thou Shall Scan The WiFis
- 7:04File Integrity Monitoring
- 13:52Thou Shalt
- 14:45Where do you find your web servers
- 16:15The guess
- 17:06Happy Hour
- 17:30The nightmare
- 19:22SSL cipher suite
- 20:24Curl
- 21:25Running the query
- 21:44Why the query doesnt match
- 22:59The point in time problem
- 23:41Thou Shalt verification
- 24:35Date math
- 26:01Summary
related talks
20mLeveraging Osquery for DFIR at Scale
22mIntrospecting your machines with osquery
46m2014.10.29 - Security@Scale - Mike Arpaia, Facebook
40mBeyond Endpoint Security Using Osquery at Scale
19mSecuring the endpoint with open software
29mTurn On the Lights
19mOXO: Orchestrating Security Scans Like a Pro
32mA Case Study of MacOS Supply Chain Compromise