Any osquery users also using (or considering) Falco?
(Asking because I'm wondering if it would be useful to build an integration with osquery and/or Fleet)
10/06/2021, 7:36 PM
I am struggling to think about the use case here, would that mean that Fleet would be acting as the ingestion point, but having no control over pushing down rules, etc.?
10/06/2021, 7:53 PM
It seems like an interesting question. As I understand it, falco gathers something like audit/kprobe/bpf events, and then does analysis on them.
Would a hypothetical perfect-world integration look like:
1. osquery has access to the falco alert stream? This feels weird and out of scope
2. osquery has access to the falco sensor data? This feels better approached via bpf tables, or a kprobe table
3. falco has access to osquery data? Feels akin to streamalert
I really want there to be an interesting overlap, but I haven’t come up with it yet.
10/06/2021, 8:38 PM
Initially I think it would be more like #1 -- osquery has access to other streams such as syslog, ASL, windows eventlog -- I wonder if it would be useful for osquery to be able to ship the Falco alerts into the same logging pipeline that folks already have set up. Additionally, if osquery is running on the container host, there are other tables that could have value.
#2 and #3 totally agreed it doesn't make much sense.
If I were to approach such a thing initially it might be an osquery extension in Go that just makes the Falco events available. I could also theoretically see Fleet being able to manage rules and that kinda thing, but it would be further down the line after proving out the idea that it's useful for logs generated by Falco to flow through that same logging pipeline.
10/06/2021, 11:08 PM
ive been thinking about looking at falco most likely to replace auditd but i havent really had time to dig into it
10/06/2021, 11:31 PM
#1 Would this option require deploying both osquery and Falco inside k8s pods?
10/07/2021, 12:33 AM
It would not need to run inside each pod. Both osquery and Falco would run on the host (or within a single container on the host).
10/07/2021, 12:46 AM
More data in structured format is interesting.
Mingling events with static data is very CEP. Not sure what I want to do with this observation.