hi all .. embarrassed to start with maybe the most noob question ever, but how do you trust that the osquery instance running on some machine is the real thing, and not an impostor sending back bogus or tampered telemetry?
11/22/2022, 4:38 PM
I’m not sure there’s a simple answer. Generally speaking, this is a hard problem for all EDR software.
How do you trust the thing on the other end is what you think.