MuleSoft: Cloud governance and compliance with osquery
summary
A directory traversal CVE forces a build of an osquery-based inventory and monitoring pipeline that achieves 100% osquery coverage across ~100,000 runtimes and ~4–5k management hosts by mapping EC2 instance IDs or unique IPs to osquery hosts, comparing inventories twice daily, and alerting via email/Slack. Detection integrates osquery (Optics), Sumo for logs, and Nessus agents; uses the ec2 instance metadata table and processes table removed event to find absent collectors. Outcome: reliable monthly FedRAMP reporting and faster incident evidence.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:15Disclaimers
- 1:57Agenda
- 3:02Customer runtime
- 4:50Getting to 100 assets reporting
- 8:28Getting inventory from AWS
- 9:40EC2 instance metadata table
- 10:45OS query performance issues
- 13:10CIS and FedRAMP
- 14:00FedRAMP
- 15:52Detecting processes
- 17:35Lessons learned
related talks
40mBeyond Endpoint Security Using Osquery at Scale
20mLeveraging Osquery for DFIR at Scale
19mSecuring the endpoint with open software
19mOXO: Orchestrating Security Scans Like a Pro
44mCloud Metadata Abuse
01h 00mVulnerability management at scale drives enterprise transformation
12mCloud security: A critical part of your exposure management program
29mTurn On the Lights