Securing the endpoint with open software
summary
Open-source osquery collects SQL-style tables from Windows Mac Linux and Chromebooks and Fleet manages it at scale across thousands to hundreds of thousands of hosts. Demo builds a GitOps workflow: a YAML query (example select star from users) set to run every 10 seconds detects sshd on nonstandard ports, CI merges the PR and applies configs to Fleet and Matano which generates alerts and ships JSON logs to S3/Splunk/Snowflake. Packages are produced as MSI PKG deb and rpm and everything used is MIT-licensed.
AI-written summary · about
chapters (13)
- 0:00intro
- 1:43preamble
- 2:12about zach
- 2:38what is an endpoint?
- 3:35osquery
- 4:44select * from users;
- 6:57select * from processes
- 7:38about fleet
- 9:54demo
- 15:27deployment
- 16:43architecture
- 17:39osquery deployment
- 18:43thank you!
related talks
29mTurn On the Lights
40mBeyond Endpoint Security Using Osquery at Scale
46m2014.10.29 - Security@Scale - Mike Arpaia, Facebook
22mUsing osquery as an SSH replacement for remote host investigation
22mIntrospecting your machines with osquery
28mLinux Efficacy @Scale
20mLeveraging Osquery for DFIR at Scale
27mThou Shalt Query: Compliance Ideas with Osquery