Maybe I’ll start with a quick overviews…. • osquery is usually an agent on machines. • It can run scheduled queries or on-demand queries • It can run standalone or connected to some kind of fleet controller. • When running standalone, people probably have some kind of config management to manage the configuration • When running standalone. people probably ship the logs into some log processing framework • Taking action on log results is a big topic • The different bits of software all present somewhat different possibilities (I work for Kolide, so I’m going to be a bit biased towards our offerings)