Sharvil Shah

Security Stuff — #osquery Technical Steering Committee member, likes macOS internals

[Pete Markowsky @PeteMarkowsky]

Lots of the hardening in this release came from us proactively auditing Santa w/LLMs

If you're responsible for any OSS, I highly recommend doing the same. You want to be the one finding the bugs first

Very happy we invested heavily in design, least privilege & invariants

[Sharvil Shah @sharvil]

@rrcyrus @OpenAI Congratulations!

[Sharvil Shah @sharvil]

@Ekaeoq @0xCookiespie It’s a great lamp, from a brand that “sucks” haha! Thinking of adding a floor version of that

[Sharvil Shah @sharvil]

@awesomekling Had the same issue. Support does not exist. But I figured it out — I had to cancel my subscription, let it expire and then “reenroll” with the link in the email

[Sharvil Shah @sharvil]

@martinamps @Prince_Canuma @AnthropicAI Hello Martin! I am also running into the same issue! Mind if I DM you?

[Sharvil Shah @sharvil]

@theevilbit @PeteMarkowsky @northpolesec Thanks :)

[Sharvil Shah @sharvil]

@iamevltwin @PeteMarkowsky @northpolesec Thanks :)

[Sharvil Shah @sharvil]

@L0Psec @PeteMarkowsky @northpolesec Thanks :)

[Sharvil Shah @sharvil]

@khronokernel @northpolesec @PeteMarkowsky Thanks 😀

[Sharvil Shah @sharvil]

Some belated personal news, so excited to have joined @northpolesec! It’s been amazing working on proactive endpoint security with @PeteMarkowsky and everyone at North Pole Security!

[Pete Markowsky @PeteMarkowsky]

So much good stuff in 2026.2 with more to come.

Process tree rules with Workshop is something we've been trying to get into Santa for years it is amazing to finally have it here!

Also big shout out to @sharvil who joined @northpolesec recently. He's great and we're so glad he's here.

[Sharvil Shah @sharvil]

@skrappy0x4a @northpolesec @PeteMarkowsky Thanks!

[Erika Noerenberg [email protected] @gutterchurl]

Starting to think I should have made #OBTS bingo cards - I don’t think I’ve ever heard a speaker use the phrase “bee’s knees” before 😹
@sharvil dropping some jokes along with FSKit knowledge ❤️

[Doc Dave @forensicdave]

Sharvil (@sharvil) showed #OBTS how Apple’s new FSKit lets you build filesystems in userspace - you can build a pseudo-FS, use it as a honeypot for infostealers and even a hiding spot for malware. DM him if you need help using this as a Canary/tripwire in your environment!

[Sharvil Shah @sharvil]

I’m gonna be @MacDevOpsYVR, come say hello!

[Pete Markowsky @PeteMarkowsky]

Really happy to see this as @sharvil's @osquery work gets called out, along with Santa's FAA.

[Sharvil Shah @sharvil]

@supersat I would start with es_logger, and I have built similar functionality into osquery too

[Sharvil Shah @sharvil]

@theevilbit Nice work!

[Sharvil Shah @sharvil]

@kieczkowska I have been looking for something quite similar, haven’t found anything, but trying Sunsama next

[Sharvil Shah @sharvil]

@patrickwardle @macsysadmin It was great to see you! Amazing photos! (And also your talk :))

[Lorenzo Franceschi-Bicchierai @lorenzofb]

NEW: We have launched a glossary where we have a series of cybersecurity terms and their definitions.

This page will be periodically updated to add more terms, as it's meant to be a live resource for all our readers.

Please let us know what to add!

https://t.co/IGdruBJvs3