3 ms·
There is an open source alternative. GRR: https://github.com/google/grr https://github.com/google/grr Every Google client device has it.
by plantain 2y ago
There is an open source alternative. GRR:
https://github.com/google/grr https://github.com/google/grr
Every Google client device has it.
- 0xBDB 2y agoThere are lots of variants of this. Wazuh, Velociraptor, etc. They have several problems. One is that user-mode EDR is just not very efficient and effective, and kernel mode requires Microsoft driver signing. There are some hoops for that, and I don't know how hard they are, but I don't know of any of these products that seems to be jumping through them. The other issue is that detection engineering is really expensive, so the detections that are included with CrowdStrike out of the box are your problem if you're using a free product. From a cost perspective you're not getting off a lot cheaper and trying to sell open source and a detection engineer's salary to a CISO who can just buy CrowdStrike instead is understandably a pretty tough sell. Or it was until this weekend, anyway.
- G3rn0ti 2y agoIt sounds really interesting. But the only thing it does not do is scanning for vira/malwares, although this could be implemented using GRR I guess. How does Google mitigate malware threats in-house?