osquery@scale 2020
2020-01-22
San Francisco, United States
as the organisers put it
Learn more about the inaugural osquery@scale conference, taking place January 22-23, 2020 in San Francisco.
| title | author | length |
|---|---|---|
| Keynote: Incident Investigation at Planetary Scale | Andy Ellis | 32m |
Telemetry-first incident response for a global CDN that handles ~100 TB/s and quarter of a million servers across 1,500 networks and 136 countries uses… | ||
| How Stripe is actioning the osquery API at scale | Matthew Kemelhar, Russ Nolen | 27m |
Stripe codifies osquery detections into a Git-backed YAML repo with linting and Jenkins deployment, converts query results into pandas dataframes via Python… | ||
| The osquery Agent. Performance Tuning @Scale | Zach Wasserman | 29m |
osquery includes a watchdog that limits a worker to 10% CPU for 12s and 200MB RAM (configurable to 5%/6s/100MB or disabled) and blacklists offending queries… | ||
| Thou Shalt Query: Compliance Ideas with Osquery | Justin Mitzimberg | 27m |
Shows six concrete osquery techniques: run Wi-Fi_survey across the 10 closest Macs per AP to quarterly-scan Wi‑Fi, use the block_device+mount join to target… | ||
| Linux Efficacy @Scale | Erin Palmer, Abubakar Yousafzai | 28m |
Comcast chooses osquery via Optics as a single agent to cover configuration compliance, real‑time file integrity monitoring and a data‑recorder style EDR… | ||
| MuleSoft: Cloud governance and compliance with osquery | Chris Byron | 20m |
A directory traversal CVE forces a build of an osquery-based inventory and monitoring pipeline that achieves 100% osquery coverage across ~100,000 runtimes and… | ||
| Optimizing Telemetry Collection & Resource Utilization | Uma Reddy, Seshu Pasam | 26m |
Uma Reddy, VP of Engineering & Co-Founder, Uptycs
Seshu Pasam, Chief Software Architect, Uptycs
The greatest risk of deploying osquery at scale in a… | ||
| Airbnb's 5 year osquery adventure | Samuel Keeley | 24m |
Airbnb describes a five year osquery rollout that replaces dual agents by sending osquery results into AWS Kinesis and processing them with StreamAlert for… | ||
| Resource Efficient Malware Scans with YARA + osquery | Julian Wayte | 26m |
Shows how YARA rules run against files discovered by osquery so scans target executed binaries and monitored directories rather than blind mass scanning. Tests… | ||
| Breach - ATT&CK - Osquery | Guillaume Ross | 27m |
Maps SingHealth and NotPetya breach reports to MITRE ATT&CK and shows concrete osquery checks that detect real steps not abstract defenses. Calls out initial… | ||
| Stripe: Automated In Memory Forensics | Carl Vincent | 09m |
Stripe builds an OSquery extension that exposes a proc_dump table to perform targeted in‑memory process dumps triggered by SIEM signals like GetAsyncKeyState… | ||
| Using osquery as an SSH replacement for remote host investigation | Mitchell Grenier, Andrew Guthrie | 22m |
goquery uses the osquery distributed API to give a shell-like investigator workflow that stays SQL-only so destructive actions (rm, chmod) are effectively… | ||
| Scaling osquery with pure open source tech | Javier Marcos | 31m |
Explains how the osquery remote API maps to three concrete handlers—enroll, config and log—plus distributed read/write and optional file‑carving endpoints, and… | ||
| osquery from a Cloud-Native and Zero Trust Perspective | Kathy Wang, Paul Harrison | 21m |
GitLab uses osquery as a building block of a Zero Trust roadmap, running a proof‑of‑concept that does phone home verification to attest device configuration… | ||
| nothing matches | ||