@dguido @bruienne @alessandrogario i guess i am just nervous because the API is not documented and all existing tools that use it are more-or-less demo style tools. is it a priority for duo to keep running (and paying for) this API, even if hundreds of thousands of hosts start querying it constantly? this data needs to be updated… is that going to be consistently staffed by duo moving forward? the API implementation and the data that powers it is also closed-source as far as i know? it seems odd to me that the “product” of the research (the real value-add) feels like something that is hidden behind an opaque api.. why not open source the implementation of the API and the datasets used to power it? it doesn’t seem like there NEEDS to be an API, we just want the information really. i guess the efigy API feels like threat intelligence with regards to how it’s being used right now, but unlike intel feed providers there is no API documentation, no information on the future of the API and how it should be used in an intelligence feed style context, no extendability for other kinds of similar analytics that you’d want to do, no common format to be consumed by intrusion detection tools, etc. perhaps duo would distribute the underlying data and let us bundle it statically in osqueryd. maybe an API could be used to periodically pull a new static data bundle of EFI mappings?