https://github.com/osquery/osquery logo
Title
r

Robin Sommer

03/24/2020, 7:31 AM
We posted this yesterday: https://zeek.org/2020/03/23/announcing-the-zeek-agent. Many thanks to @alessandrogario and Trail of Bits for their great work pulling this together!
s

stefanmaerz

03/24/2020, 12:29 PM
Is this a fork of osquery built specifically to integrate with Zeek?
a

alessandrogario

03/24/2020, 12:29 PM
No, it works with standard osquery!
If there's anything that doesn't work with upstream binaries let us know and we'll open an issue 🙂
s

stefanmaerz

03/24/2020, 12:30 PM
yes, helps if i read the artcle first 'Eventually, this process evolved into a clean rewrite to produce an entirely new agent that can operate both in a standalone fashion and with osquery.' 🙂
I'm definitely intrigued by this. Contextualizing and correlating network log sources is something i'm working on right now. Is the idea behind this the same as the original bro-osquery project back in the day? Where Zeek can ask the endpoint for host (process/user) data to contextualize network logs? If so that is 🔥🔥🔥
a

alessandrogario

03/24/2020, 7:03 PM
Yes, something like that 🙂
🔥 1