osquery (@osquery) profile picture

osquery

@osquery

osquery lets you ask questions about your Linux, Mac, and Windows infrastructure. Intrusion detection, infrastructure reliability, compliance, and more.

 Menlo Park, CA
osquery.io/
Joined February 2015
  • Tweets208
  • Following130
  • Followers3.1K
3Media
Photo by osquery (@osquery)Photo by osquery (@osquery)Photo by osquery (@osquery)
Include

Only show posts containing:

Exclude

Hide posts containing:

Time range
-
Minimum likes
Great to see osquery detections provided in a malware analysis report like this!
Bhargav koduru (@brkoduru) profile pictureBhargav koduru@brkoduru12 Apr 2023
Here's my blog on #Qakbot malware with threat detections using #osquery Qakbot seen in below campaigns: ⛔️OneNote Campaign ⛔️WSF Campaign ⛔️HTML Smuggling Campaign Blog: research.loginsoft.com/threa… #threatintelligence #malware #threathunting #DFIR
Research As A Service | Loginsoft

Research As A Service | Loginsoft

Unlock cutting-edge cybersecurity insights with Research-as-a-Service. Empower your strategies with our in-depth analyses and innovations.

loginsoft.com
2
7
1,562
Here's a little one-liner I like to use with @osquery to figure out what process is listening on a network port when I can't bind my dev server: osqueryi 'select * from processes join listening_ports using (pid) where port = 8080'
4
2
10
1,078
Team @docker, what's the plan for OSS organizations that use the free team tier with your new pricing announcement (sunsetting the free teams tier)? Are projects like @osquery no longer welcome on the platform?
2
2
4
1,230
🎉 Announcing Osquery 5.3.0! 🎉 Table improvements and bugfixes. Downloads available from osquery.io/downloads/officia…
2
6
1
20
Anyone know of a tool like @snyksec that supports C++ and can generate *public* reports of dependency vulnerabilities and fixes? Snyk seems to have a nice workflow but doesn't support the public reporting use case. Looking to address this issue for @osquery.
2
1
3
🎉 Announcing osquery 5.2.2 with native macOS M1 support! 🎉 Downloads available in our package repos and at osquery.io/downloads/officia…. Huge effort from @trailofbits, @Smjert, @alessandrogario, @sharvilshah and more.
14
2
38
Replying to @wifitoaster2
Osquery is not vulnerable. See teapawt.net/osquery/status/1470831…. Thank you for asking.
osquery (@osquery) profile pictureosquery@osquery14 Dec 2021
Osquery is not vulnerable to the Log4J CVE-2021-44228, as there are no Java components. The osquery.io website is statically hosted on GitHub pages.
Osquery is not vulnerable to the Log4J CVE-2021-44228, as there are no Java components. The osquery.io website is statically hosted on GitHub pages.
2
1
10
Announcing, osquery 5.0! 🎉 This is a tremendously exciting release. New code signatures, new paths, new packaging, new functionality! Check it out at github.com/osquery/osquery/r…
Release 5.0.1 · osquery/osquery

Release 5.0.1 · osquery/osquery

osquery 5.0 is a tremendously exciting release! We now install into /opt/osquery on macOS and Linux for better portability. Our default and recommended installation for macOS uses an application b...

github.com
2
11
2
31
Replying to @mikermcneil @KevTheHermit
Yeah this is a known problem, we’d love some help fixing that initial load bug on github.com/osquery/osquery-s…
GitHub - osquery/osquery-site: The public website for osquery.io

GitHub - osquery/osquery-site: The public website for osquery.io

The public website for osquery.io. Contribute to osquery/osquery-site development by creating an account on GitHub.

github.com
1
1
1
cloudquery looks great! A wonderful complimentary tool to osquery, query your endpoints and your cloud! What’s next? github.com/cloudquery/cloudq…
GitHub - cloudquery/cloudquery: Data pipelines for cloud config and security data. Build cloud...

GitHub - cloudquery/cloudquery: Data pipelines for cloud config and security data. Build cloud...

Data pipelines for cloud config and security data. Build cloud asset inventory, CSPM, FinOps, and vulnerability management solutions. Extract from AWS, Azure, GCP, and 70+ cloud and SaaS sources. -...

github.com
4
15
Very cool to see the initial talks and speakers added to the agenda, should be a fun and insightful event!
osquery@scale (@osqueryatscale) profile pictureosquery@scale@osqueryatscale14 Dec 2020
While CFPs continue to roll in, we’re excited to share the latest confirmed speaker/session: @atlassian Site Reliability Engineer, Brendan Shaklovitz (@nyanshak). To register, visit eventbrite.com/e/osqueryscal… #osqueryatscale
Image from osquery@scale (@osqueryatscale)
4
10
Keep them coming!
𝙹𝚊𝚟𝚒𝚎𝚛 𝙼𝚊𝚛𝚌𝚘𝚜 ⚡️ (@javutin) profile picture𝙹𝚊𝚟𝚒𝚎𝚛 𝙼𝚊𝚛𝚌𝚘𝚜 ⚡️@javutin9 Nov 2020
The importance of APIs in Security products is often ignored. A good API makes your product even better and us Security Engineering teams love them! javuto.medium.com/introducin… #CyberSecurity #DFIR #osquery #detection #infrastructure
Introducing osctrl-api

Introducing osctrl-api

Osctrl was originally released, as a performant TLS endpoint for osquery, with an initial set of features, such as modular components or…

javuto.medium.com
1
6
The osquery ecosystem keeps growing!
Fleet (@fleetctl) profile pictureFleet
@fleetctl5 Nov 2020
A new Fleet for @osquery medium.com/fleetdm/a-new-fle…
A New Fleet

A New Fleet

Learn how Fleet is changing and evolving to continue leading endpoint security with osquery.

medium.com
4
13
This makes bpf events very accessible: select * from bpf_process_events. You’ll have to build from tip right now, but expect these features in the next stable release (eta 1 month). Next up, EndpointSecurity process events!
Alessandro Gario (@alessandrogario) profile pictureAlessandro Gario@alessandrogario16 Oct 2020
My PR implementing #bpf support in #osquery has been merged! Huge thanks to @trailofbits for being awesome and @teddyreedv for being the best maintainer ever! github.com/osquery/osquery/p…
Initial implementations for BPF-based socket and process events tables by alessandrogario · Pull...

Initial implementations for BPF-based socket and process events tables by alessandrogario · Pull...

This PR implements two new tables: bpf_process_events, bpf_socket_events using the ebpfpub library from https://github.com/trailofbits/ebpfpub. BPF support requires a kernel >= 4.18! VMware ...

github.com
1
3
4
21
Here is a great end to end setup for using osquery to carve/acquire files remotely. Thanks for the in-depth description and walkthrough Ben!
Ben Bornholm (@CptOfEvilMinion) profile pictureBen Bornholm@CptOfEvilMinion24 Sep 2020
New post: Setup my GoLang Osquery-file-carving server with Kolide holdmybeersecurity.com/2020/…
8
That is a lot of SQL! Congrats to the winners and to everyone who helped organize!
Recon InfoSec (@Recon_InfoSec) profile pictureRecon InfoSec@Recon_InfoSec9 Aug 2020
We are thrilled to announce the winning teams of OpenSOC.io #DEFCONSafeMode finals. 8M @graylog2 queries 91K+ scoreboard submissions 800+ participants 500+ challenges 350+ teams 260GB+ PCAPs 150GB+ endpoint telemetry 10K+ @osquery queries 20+ hours of content
Image from Recon InfoSec (@Recon_InfoSec)
1
5
I'm very excited to release Fleet 3.0.0! We've managed to scale Fleet to over 150k hosts with the new changes, and also introduced some nice new features like Manual Labels. Check it out! #osquery github.com/kolide/fleet/rele…
Release 3.0.0 · kolide/fleet

Release 3.0.0 · kolide/fleet

Changes Backend performance overhaul. The Fleet server can now handle hundreds of thousands of connected hosts. Pagination implemented in the web UI. This makes the UI usable for any host count...

github.com
2
16
2
47
Replying to @jmeller @kolide
There are multiple hubs already, if you want to use those or derive inspiration. community.carbonblack.com/t5… and the second I cannot find right now but I saw demoed at DEF CON last year.
1
4
Enjoyed my first virtual talk at @jupyterthon and also my first blog, hope there will be more! 😉 Thanks again @Cyb3rWard0g & @Cyb3rPandaH for this opportunity. Here is the link to my talk: youtube.com/watch?v=QCVd4Svt… And also the link to my blog: medium.com/@sevickson/untang… #osquery
Infosec Jupyterthon 2020!

Infosec Jupyterthon 2020!

The first Infosec Jupyter event. An open community event for securi...

youtube.com
3
13
Load more