Using osquery as an SSH replacement for remote host investigation
summary
goquery uses the osquery distributed API to give a shell-like investigator workflow that stays SQL-only so destructive actions (rm, chmod) are effectively disallowed. v2 splits custom commands from core so teams compile their own extensions into the binary, and it logs every scheduled query and response for audit. Implementation requires three backend APIs, supports accelerated mode (polling as fast as every 2 seconds), and already has integrations for OSControl and Fleet.
AI-written summary · about
chapters (6)
- 0:00Introduction and presenters
- 1:05Why build osquery SSH replacement
- 3:56How osquery SSH replacement works
- 8:33Implementation details and API
- 17:09Mistakes in v1 and v2 improvements
- 20:18Future plans and summary
related talks
22mIntrospecting your machines with osquery
20mLeveraging Osquery for DFIR at Scale
46m2014.10.29 - Security@Scale - Mike Arpaia, Facebook
19mSecuring the endpoint with open software
40mBeyond Endpoint Security Using Osquery at Scale
29mTurn On the Lights
19mOXO: Orchestrating Security Scans Like a Pro
16mInfrastructure security, visibility and cost-optimization