https://github.com/osquery/osquery logo
Title
z

Zach Zeid

12/08/2020, 2:36 PM
I've another question; Is there a way for osquery to understand significant changes to something over time? e.g. I want to track number of open connections where that number is a delta between two points in time.
a

alessandrogario

12/08/2020, 3:43 PM
Would it be useful to use the socket_events/bpf_socket_events tables and count the connect actions?
z

Zach Zeid

12/08/2020, 3:44 PM
I don't know, we haven't implemented any
event
tables as of now. The documentation makes it seem like it's very resource intensive, and could break in a lot of different ways.
a

alessandrogario

12/08/2020, 3:56 PM
But that only creates a diff between two states, and ignores everything that happened between them
z

Zach Zeid

12/08/2020, 3:57 PM
yeah, that's what I was thinking as well. There is also my inexperience with how an
events
table would solve this.
z

zwass

12/08/2020, 4:22 PM
Could you run something like
select count(*) from process_open_sockets
?
z

Zach Zeid

12/08/2020, 4:24 PM
That was my original thought actually. The problem is being able to establish a baseline, and then saying "anything over this baseline is alertable." Honestly, I don't know if this is a problem for osquery to solve.
z

zwass

12/08/2020, 4:27 PM
This is something you would typically do in the logging pipeline. Osquery can of course expose the data. I know tools like Elastalert can set up alerts based on changes from baseline.
z

Zach Zeid

12/08/2020, 4:28 PM
Yeah, everything we do gets ingested by Streamalert, which doesn't really have the concept of state in this case.