Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

<https://danielmiessler.com/blog/continuous-asset-management-security/>

i totally intend to get back to queryhub soon, have been moving the past few weeks

I intend to as well, been on a working vacation for about a month now

hey channel :smile: will the secret be out soon for the conf date?

Wouldn’t mind knowing the secret cause yearly planning is ... freak, one month left in Q1! 

I think my co-workers and I plotted out all of the infosec conferences on a whiteboard once, back in 2010, and decided that there was one every weekend of the year somewhere

I have a spreadsheet just with those of interest to me, and it’s 107 rows. 

That animated Sonic on <@U2NMC13UJ>'s slide just blew my mind.

<@U2NMC13UJ> Enjoyed your talk, I feel like so many tools are just not built for ephemeral instances at all but with osquery + some tricks as you described we can get something good (nothing's perfect)!

Yeah, it's a tough one without modify osquery itself. Lots of ways to get better though!

Re: Current discussion about "Query Matrix" - for those interested, <@UBAU3T7V4> has some great work done on <https://github.com/teoseller/osquery-attck> already

I have been using this to start mappings - extremely helpful

If you push your packages with MDM, you don’t need to notarize

Good point, but for people with customers who aren't gonna be on MDM 100% of the time, we need to have a good workflow to get that done too. For internal needs with MDM there's probably no need for EV certs etc either :slightly_smiling_face:

sure, but osquery is also largely going to work less and less for customers without mdm

kolide builds unique packages for each customer because it includes enrollment secrets /config specific for that customer

but they could also build + notarize a single package with no configuration for everyone

and use a different method for configuration

yeah, it’s a convenience thing which is probably not a use case apple is thinking about

I think I would rather have a immutable package, and have a way to specify config with arguments than hope notarization will always happen at the speed I would want it to, but who knows maybe it'll scale too!

there’s other tools that ship config (cisco comes to mind)

Hi folks, my slides are available at <https://www.dactiv.llc/blog/10-pitfalls-on-the-path-to-osquery-bliss/>. Thanks for coming!

Thanks, I really liked it, a few of them made me rage in the past and a few of them I haven't hit personally so it's great to have as a reference!

Securing_osquery__Notes_from_the_workshop_.txt

Super interesting notes Mike, thank you for sharing!

I was however tasting LaCroix for the first time because Tania gave me an extra can