2014.10.29 - Security@Scale - Mike Arpaia, Facebook

on YouTube ↗46m

" summary

Facebook open sources osquery, a tool that exposes OS state as SQL tables so engineers can run queries like select from launchd or select from kernel_modules; it uses RocksDB for history, a plugin system for logging/config, and a Python/C++ API to add tables. osqueryi provides an interactive shell, osqueryd schedules queries and osqueryd emits state-change logs; builds include Vagrant dev VMs and Travis CI, and the project already shows 500+ commits and ~200 PRs across OSX, Ubuntu and CentOS support.

AI-written summary · about

" chapters (15)

1. 0:00Intro
2. 1:29we're all trying to catch attackers it's a hard problem insider threats -espionage
3. 2:12we're all deploying tools we need help many of us have too many vendor products often times, a product solves too narrow of a use-case
4. 3:03we live in a windows centric world but, times are changing
5. 6:35performant and reliable
6. 8:10easy to integrate
7. 10:57osquery SQL for your infrastructure use SQL queries to explore OS state running processes loaded kernel modules active network connections * route table - firewall settings installed software and more
8. 16:36many tables are available more tables are being written every day
9. 17:21use simple tables, together osquery enables complex analysis by allowing users to join and aggregate across several simple tables * Simple tables have many advantages
10. 19:15osqueryd daemon for low-level host monitoring
11. 22:33plugin system for config distribution and data infrastructure simple plugin API specify your plugins at runtime with a command-line flag
12. 25:02creating tables is easy
13. 28:21cross-platform build infrastructure
14. 32:43extensive documentation many tutorials and guides
15. 35:35what we're working on contribute and help us build an awesome tool

" related talks

• 22mIntrospecting your machines with osqueryIan Littman · DevOpsDays Austin 2025
• 27mThou Shalt Query: Compliance Ideas with OsqueryJustin Mitzimberg · osquery@scale 2020
• 24mAirbnb's 5 year osquery adventureSamuel Keeley · osquery@scale 2020
• 20mLeveraging Osquery for DFIR at ScaleSohini Mukherjee · BSidesSF 2020
• 22mUsing osquery as an SSH replacement for remote host investigationMitchell Grenier, Andrew Guthrie · osquery@scale 2020
• 19mSecuring the endpoint with open softwareZach Wasserman · Conf42 DevSecOps 2023
• 40mBeyond Endpoint Security Using Osquery at ScalePrasoon Dwivedi, Prateek Kumar Nischal · RSAC 2021
• 31mScaling osquery with pure open source techJavier Marcos · osquery@scale 2020