osquery

osquery lets you ask questions about your Linux, Mac, and Windows infrastructure. Intrusion detection, infrastructure reliability, compliance, and more.

[osquery @osquery]

Great to see osquery detections provided in a malware analysis report like this!

[Bhargav koduru @brkoduru]

Here's my blog on #Qakbot malware with threat detections using #osquery

Qakbot seen in below campaigns:
⛔️OneNote Campaign
⛔️WSF Campaign
⛔️HTML Smuggling Campaign

Blog: https://t.co/mx6CHbYobm

#threatintelligence #malware #threathunting #DFIR

[Zach Wasserman @thezachw]

Here's a little one-liner I like to use with @osquery to figure out what process is listening on a network port when I can't bind my dev server:

osqueryi 'select * from processes join listening_ports using (pid) where port = 8080'

[Zach Wasserman @thezachw]

Team @docker, what's the plan for OSS organizations that use the free team tier with your new pricing announcement (sunsetting the free teams tier)? Are projects like @osquery no longer welcome on the platform?

[osquery @osquery]

🎉 Announcing Osquery 5.3.0! 🎉

Table improvements and bugfixes. Downloads available from https://t.co/lwciRnuZHp

[Zach Wasserman @thezachw]

Anyone know of a tool like @snyksec that supports C++ and can generate *public* reports of dependency vulnerabilities and fixes? Snyk seems to have a nice workflow but doesn't support the public reporting use case. Looking to address this issue for @osquery.

[osquery @osquery]

🎉 Announcing osquery 5.2.2 with native macOS M1 support! 🎉

Downloads available in our package repos and at https://t.co/NPm0pB3tuW. Huge effort from @trailofbits, @Smjert, @alessandrogario, @sharvilshah and more.

[osquery @osquery]

@wifitoaster2 Osquery is not vulnerable. See https://t.co/M92EfdSIzL. Thank you for asking.

[osquery @osquery]

Osquery is not vulnerable to the Log4J CVE-2021-44228, as there are no Java components. The https://t.co/G7Qr0iNunH website is statically hosted on GitHub pages.

[osquery @osquery]

Osquery is not vulnerable to the Log4J CVE-2021-44228, as there are no Java components. The https://t.co/G7Qr0iNunH website is statically hosted on GitHub pages.

[osquery @osquery]

Announcing, osquery 5.0! 🎉

This is a tremendously exciting release. New code signatures, new paths, new packaging, new functionality!

Check it out at https://t.co/iRsR1j4rve

[osquery @osquery]

@mikermcneil @KevTheHermit Yeah this is a known problem, we’d love some help fixing that initial load bug on https://t.co/DWwqRZHL05

[osquery @osquery]

cloudquery looks great! A wonderful complimentary tool to osquery, query your endpoints and your cloud! What’s next? https://t.co/EHImJeueEA

[osquery @osquery]

Very cool to see the initial talks and speakers added to the agenda, should be a fun and insightful event!

[osquery@scale @osqueryatscale]

While CFPs continue to roll in, we’re excited to share the latest confirmed speaker/session: @atlassian Site Reliability Engineer, Brendan Shaklovitz (@nyanshak).

To register, visit https://t.co/FbNwyscgbK

#osqueryatscale

[osquery @osquery]

Keep them coming!

[𝙹𝚊𝚟𝚒𝚎𝚛 𝙼𝚊𝚛𝚌𝚘𝚜 ⚡️ @javutin]

The importance of APIs in Security products is often ignored. A good API makes your product even better and us Security Engineering teams love them! https://t.co/HyhEubpf3k #CyberSecurity #DFIR #osquery #detection #infrastructure

[osquery @osquery]

The osquery ecosystem keeps growing!

[Fleet @fleetctl]

A new Fleet for @osquery

https://t.co/UR5kvewJGw

[osquery @osquery]

This makes bpf events very accessible: select * from bpf_process_events. You’ll have to build from tip right now, but expect these features in the next stable release (eta 1 month). Next up, EndpointSecurity process events!

[Alessandro Gario @alessandrogario]

My PR implementing #bpf support in #osquery has been merged! Huge thanks to @trailofbits for being awesome and @teddyreedv for being the best maintainer ever! https://t.co/n35EPhi2UC

[osquery @osquery]

Here is a great end to end setup for using osquery to carve/acquire files remotely. Thanks for the in-depth description and walkthrough Ben!

[Ben Bornholm @CptOfEvilMinion]

New post: Setup my GoLang Osquery-file-carving server with Kolide https://t.co/grj4Olk4zW

[osquery @osquery]

That is a lot of SQL! Congrats to the winners and to everyone who helped organize!

[Recon InfoSec @Recon_InfoSec]

We are thrilled to announce the winning teams of https://t.co/ppYocDgP90 #DEFCONSafeMode finals.

8M @graylog2 queries
91K+ scoreboard submissions
800+ participants
500+ challenges
350+ teams
260GB+ PCAPs
150GB+ endpoint telemetry
10K+ @osquery queries
20+ hours of content

[Zach Wasserman @thezachw]

I'm very excited to release Fleet 3.0.0! We've managed to scale Fleet to over 150k hosts with the new changes, and also introduced some nice new features like Manual Labels. Check it out! #osquery

https://t.co/E6BgbSprVW

[osquery @osquery]

@jmeller @kolide There are multiple hubs already, if you want to use those or derive inspiration. https://t.co/Xwj2Jovq3E and the second I cannot find right now but I saw demoed at DEF CON last year.

[Sevickson @SKwid345]

Enjoyed my first virtual talk at @jupyterthon and also my first blog, hope there will be more! 😉
Thanks again @Cyb3rWard0g & @Cyb3rPandaH for this opportunity.
Here is the link to my talk: https://t.co/AYSStDF8ZR
And also the link to my blog: https://t.co/4RV9Sgp0fS
#osquery