4 ms·
In a corporate setting: At Etsy we use OSQuery on all of our corp machines(macOS) to help with malware/virus detection. We use community rules: https://github.c
by atom_enger 8y ago
In a corporate setting: At Etsy we use OSQuery on all of our corp machines(macOS) to help with malware/virus detection. We use community rules: https://github.com/facebook/osquery/blob/master/packs/osx-attacks.conf https://github.com/facebook/osquery/blob/master/packs/osx-at...
In addition to community rules we also curate a bunch of rules in house from malware we've discovered across our fleet. We then aggregate this info into ELK and alert on it.
At Home: OSQuery as well + tiny elk stack + Elastalert. Overkill for a typical home setup but I like it.
- k_lander 8y agoGot any links to articles to walk through getting this set up?
- fritzx6 8y agohttps://blog.kolide.com/monitoring-macos-hosts-with-osquery-ba5dcc83122d https://blog.kolide.com/monitoring-macos-hosts-with-osquery-... Hope that helps! I would also recommend joining the osquery slack: https://osquery-slack.herokuapp.com/ https://osquery-slack.herokuapp.com/
- atom_enger 8y agonice thanks for the assist Zach!
- k_lander 8y agoThanks!
- Immortalin 8y agoCan you elaborate more on your home setup?