Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

We posted this yesterday: <https://zeek.org/2020/03/23/announcing-the-zeek-agent>. Many thanks to <@U6EFFT5FG> and Trail of Bits for their great work pulling this together!

Is this a fork of osquery built specifically to integrate with Zeek?

If there's anything that doesn't work with upstream binaries let us know and we'll open an issue :slightly_smiling_face:

yes, helps if i read the artcle first 'Eventually, this process evolved into a clean rewrite to produce an entirely new agent that can operate both in a standalone fashion and with osquery.' :slightly_smiling_face:

I'm definitely intrigued by this. Contextualizing and correlating network log sources is something i'm working on right now.

Is the idea behind this the same as the original bro-osquery project back in the day? Where Zeek can ask the endpoint for host (process/user) data to contextualize network logs? If so that is :fire::fire::fire:

Yes, something like that :slightly_smiling_face: