How Is osquery Used?
osquery empowers a variety of security roles with broad visibility and comprehensive analytics. Whether you’re concerned with enforcing configuration policies, SOC 2 compliance or hunting threats, osquery can help security teams secure their attack surface and drive better outcomes.
Security Configuration Management
Audit all machines in your fleet and more
Read More
Security Configuration Management
- Audit all machines in your fleet
- Identify users and connection locations
- Audit software & hardware (incl. versions)
- Identify where sensitive data lives
- Gather detailed application configuration data (with Augeus)
* To monitor configuration drift or change over time requires the ability to historically lookback and compare. Having a scalable data storage solution will be required.
Compliance
Collect a subset of data for compliance checks (osquery Compliance Query Packs)
Read More
Compliance
- Collect a subset of data for compliance checks (osquery Compliance Query Packs)
- Audit configuration settings
- Identify where sensitive data lives (with YARA + FIM)
- Scan your WiFi for unknown users
Detection & Threat Hunting
Stop lateral movement and detect behavioral anomalies
Read More
Detection & Threat Hunting
- Spot lateral movement
- Detect behavioral anomalies
- Observe open connections/ ports
- Identify & analyze malware (with YARA, JA3)
- Map endpoint data to the MITRE ATT&CK framework
- Monitor critical file activity (FIM)
- Identify root access
* When scaling open source osquery for detection and threat hunting, be aware of limitations to scale — no standard deployment exists. Open source has different functions for every user, and no two users will configure and operate the tool exactly alike.
DevOps
Find vulnerabilities early in the development process
Read More
DevOps
- Find vulnerabilities early in development
- Monitor user access
- Audit container or microservice misconfigurations
- Monitor infrastructure behavior post deployment
* osquery alone enables DevOps teams to continuously monitor their cloud applications/workloads. Visibility inside the workloads themselves (resource utilization, processes running, and network connections) will require the complimentary cloudquery extension.
IT Administration
Audit active users & unknown logins
Read More
IT Administration
- Audit active users & unknown logins
- Inventory your hardware
- Oversee your software inventory & package versions
- See how much memory is available
- Identify process performance hogs
- Examine existing extensions
How osquery Works
osquery is a small endpoint agent that makes your entire system configuration and runtime state available for query through an SQL interface, including a real-time stream of events. With osquery, you can:- run SQL queries to retrieve information from system calls, system APIs, configuration files, and your filesystem directly across your entire fleet of laptops, servers, or containers.
- schedule these queries to run periodically and be delivered to your storage destination of choice for alerting and after-the-fact investigation.
- subscribe to event sources to immediately detect new processes, network activity, and file changes. These events can be streamed to your specified destination for detection and investigation purposes.
- run ad-hoc queries through your fleet manager to investigate your system in real time.