Peeking into Linux Infrastructure to Detect Attacks
summary
Explains how to build information-security monitoring for high‑load, distributed Linux infrastructure, contrasting security monitoring tools with traditional monitoring. Compares and analyzes specific solutions such as go-audit, osquery, Wazuh, and Elastic Agent and discusses approaches to detect attacks in that environment.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 2:12Why logs for investigations
- 6:01Log collection tool choice
- 8:31How osquery works
- 10:18eBPF versus audit
- 13:11osquery stability
- 17:06Linux audit problems
- 18:55Netlink socket conflicts
- 20:23Memory consumption issues
- 22:52Resource-heavy osquery queries
- 25:41Log delivery delay
- 27:26Attack investigation example
- 31:26Benefits for ops team
- 33:10Securing log collection
- 34:36eBPF versus audit deep dive
- 36:21System information gathering
- 36:43osquery installation integrity
- 37:45osquery configuration management
related talks
33mFree SOC? — how open source tools can come to our aid
29mDetection Engineering: Defending Networks with Purpose
28mLinux Efficacy @Scale
26mContainers: Your Ally in Improving Security
32mHey Attacker! I Can See You!
58mConducting Defensive Information Warfare on Open Platforms
35mEnhancing Operations Through the Tracking of Interactive Linux-based Intrusion Campaigns
43mBuilding a network security practice in your organization | Pannel Discussion