Any plan to integrate something like google rapid ...
# general
Any plan to integrate something like google rapid response ( in OSQuery? I would be amazing to get this type of functionality from osquery directly.
👍 1
Seems like it is written in Python; there is a Python SDK to connect to osquery and export tables and other plugins
Additionally, when implemented inside an extension, a table plugin can support write access (i.e. INSERT INTO, UPDATE, DELETE FROM)
We have already seen tables that can add/remove firewall rules or kill processes
But i dont wnna install 2 different agents. If we can combine both agents that would be awesome.
They may be different projects with different goals. What abilities from GRR would you add to osquery?
Hey @seph It would be cool to get some of the below mentioned features: Agent side: • Live remote memory analysis • Powerful search and download capabilities for files • OS-level and raw file system access • Detailed monitoring of client CPU, memory, IO usage and self-imposed limits. Sever side : • Fully fledged response capabilities handling most incident response and forensics tasks. (shutting down some app, isolating machine from internet etc)
Osquery has many of those client features.
But osquery does not aim to control the machine. So the core project will not gain thjnfs like shutdown or app isolation.
I think it would be interesting if someone added that kind of functionality to an extension.