3 ms·
Our security team uses this, we’re about 1500 employees. However, I believe they opted to use a fork over this linked version, citing (IIRC) that Facebook’s roa
by gen220 7y ago
Our security team uses this, we’re about 1500 employees. However, I believe they opted to use a fork over this linked version, citing (IIRC) that Facebook’s roadmap for this project was a little bit too unpredictable, and that they weren’t responsive to PRs and community requests. I think we went with https://github.com/osql/osql https://github.com/osql/osql.
It’s installed on every laptop (chrome books and MacBooks), and I believe on every EC2 instance, and they have nothing but good things to say about it. We did have to come up with an aggregator solution for storing the results of the queries, but I’m under the impression that it wasn’t too big of a lift.
- groobongithub 7y agoFacebook has since transfered the project to the Linux Foundation, and the group behind osql is largely the same group of maintainers on the current osquery. https://www.linuxfoundation.org/press-release/2019/06/the-linux-foundation-announces-intent-to-form-new-foundation-to-support-osquery-community/ https://www.linuxfoundation.org/press-release/2019/06/the-li...
- gen220 7y agoThis is great news! Thank goodness that something like the Linux Foundation exists; this is a perfect piece of software for it to absorb.
- caniszczyk 7y agoThe osquery foundation is just getting started and holding office hours, you're welcome to join! https://github.com/osquery/foundation https://github.com/osquery/foundation
- patangay 7y agoSnowalert running on Snowflake is a reasonable aggregator/alerting solution for anyone looking to do this. https://community.snowflake.com/s/article/Snowflake-Using-Snowflake-for-Security-Analytics-and-Regulatory-Compliance https://community.snowflake.com/s/article/Snowflake-Using-Sn...
- FridgeSeal 7y agoYes but then I’d have to use Snowflake...