Linux Efficacy @Scale
summary
Comcast chooses osquery via Optics as a single agent to cover configuration compliance, real‑time file integrity monitoring and a data‑recorder style EDR, after a POC that proves visibility across 150,000 Linux endpoints plus cloud hosts. Architecture pipes telemetry into Splunk for alerts, ServiceNow for asset tickets, and Kafka/S3 for analytics; expected ingestion near 120 MB/day per host. Implementation risks are kernel‑module compatibility, noisy FIM alerts, CI/CD unit tests for agent installs, and limited built‑in remediation.
AI-written summary · about
chapters (10)
- 0:00Introduction to Linux project
- 1:28Challenges with agent deployment
- 4:17Gathering requirements and adoption
- 7:46OSQuery and technical deep dive
- 10:54CISCD integration and WannaCry story
- 13:45EDR vs data recorder approach
- 16:16Compliance standards and overlaps
- 18:24Data pipeline and ServiceNow
- 21:52Implementation challenges ahead
- 26:102020 goals and next steps
related talks
40mBeyond Endpoint Security Using Osquery at Scale
19mSecuring the endpoint with open software
46mOperational Logs and Event Management for HPC S...
17mArchitecting a security data lake at enterprise scale
40mObservability that scales: Analyze data in stream and query remotely
42mscales security capabilities with Splunk and
01h 05mPractical network defense at scale
20mLeveraging Osquery for DFIR at Scale