Beyond Endpoint Security Using Osquery at Scale
summary
An open audit framework built on osquery + Linux audit framework standardizes agent behavior, bootstraps via TLS plugins, and ships a PKI-backed signed configuration envelope so configs validate anywhere. It monitors agent version, permissions and restarts, annotates events with owner/IP/config, and funnels logs into existing pipelines for rule engines and ML. Benchmarks show manual auditctl tuning reduced CPU overhead by orders of magnitude. Code and configs live on the osquery GitHub.
AI-written summary · about
chapters (10)
- 0:00Start
- 3:03Challenges in Maintenance and Security
- 4:54Accountability and Ownership
- 8:18Requirements from a Compliance Point of View
- 10:02Bootstrapping
- 12:56Why We Chose Os Query for Our Auditing Framework
- 13:32Tls Logger Plugin
- 16:31Identity and Accountability
- 19:25Confidentiality Integrity and Accountability
- 25:14Benchmark
related talks
20mLeveraging Osquery for DFIR at Scale
31mScaling osquery with pure open source tech
24mAirbnb's 5 year osquery adventure
28mLinux Efficacy @Scale
20mMuleSoft: Cloud governance and compliance with osquery
19mSecuring the endpoint with open software
27mThou Shalt Query: Compliance Ideas with Osquery
21mosquery from a Cloud-Native and Zero Trust Perspective