Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Agenda for tomorrow’s office hours. <https://hackmd.io/uwfEWfh1TbS4xOsqJOZmYw>

Reminder: osquery office hours happening in 15 minutes <https://meet.google.com/joi-ukxw-zvv>

<https://www.youtube.com/watch?v=Lxa8s54jdA8>

Agenda doc for tomorrow. <https://hackmd.io/vt2RBL7wR4ONxO99RuxVUw?edit>

Agenda doc for later today — <https://hackmd.io/AVuEACLuRJai5iEXFrg2zQ>

Sorry I had to miss the office hours yesterday, looking forward to catching up when the video posts 

<https://www.youtube.com/watch?v=bxp6bmD0Dzg>

Agenda doc! <https://hackmd.io/gJV3yuo1Qemtoxwm3I9afQ>

<https://www.youtube.com/watch?v=i-EF4ipoHF8>

Agenda doc for tomorrow. <https://hackmd.io/Pqdoo9ynTMC5fuc_hOo57w>

This note "macOS parsing of the authorized_keys file" is also related to Linux based OS

I am under the weather today, and will miss the office hours, will catch the recording 

Agenda doc for today <https://hackmd.io/0qwzRIaERrqhvk6RI1zGQw|https://hackmd.io/0qwzRIaERrqhvk6RI1zGQw>

Hi everyone, thanks for giving me some time today to present this idea of using ETW to improve the Osquery visibility on Windows. <https://docs.google.com/presentation/d/1a1PQHWorZRbWnBvVD_rxIvrZ7NtJx1BwLE2VOFaUcXw/edit?usp=sharing|Here> is the deck I used. Thanks!

Was not in the call, but looking over the deck and notes, I would love to see something like this

I know I have chatted with multiple people on this slack over the years about finding better ways to provide sysmon type filtering / features to osquery core.

It's not an easy sell to ask people to deploy osquery + sysmon / sysmon filter config. Would be much easier if we could just deploy osquery and be done with it

Have you tried this extension? - <https://github.com/eclecticiq/osq-ext-bin|https://github.com/eclecticiq/osq-ext-bin>

I've been doing a lot of testing with it and it can provide very similar visibility as sysmon and no need for an additional agent. 

Disclaimer: I am not affiliated with that team, I just use the product. 

I agree that having this visibility right into Osquery and not have to rely on external tools such as sysmon is the way to go.

Regarding the osq-ext-bin extension, I looked into it in the past. The extension is doing a great job on providing extra visibility on windows. The only drawback is that the extension installs a new windows kernel driver to retrieve the visibility data, which is not ideal imo for a couple of reasons (unexpected crashes, system state changed, compatibility, etc)

<https://www.youtube.com/watch?v=mRKQQ-rNsVo>

Agenda doc for today <https://hackmd.io/BeZ1Qm6RSme4EydSW1wcrg>

<@U7QP20JQH> Says I’m forbidden access to it

Looks like the default permissions changed. I’e set write to signed in users. Try now?

I dunno if some default changed, or what. :shrug:

<https://www.youtube.com/watch?v=Z60oaGabfEk>