7 ms·

Google has GRR and Mozilla has MIG (http://mig.mozilla.org/ http://mig.mozilla.org/) I think its interesting to see that MIG is in Go and thus cross platform "

by zobzu 12y ago

Google has GRR and Mozilla has MIG (http://mig.mozilla.org/ http://mig.mozilla.org/) I think its interesting to see that MIG is in Go and thus cross platform "by default". It also seems to be more privacy-compliant. osquery's SQL is sexy however. That said I'm also wary of a single piece of software that basically give you control over absolutely everything (control everyones laptop, etc. silently and quickly. Thats the best rootkit ever. You wont even detect if its being compromised because its a trusted piece of the OS!)

jvehent 12y ago
MIG author here. First, congrats to Mike Arpaia for shipping! That must have been a busy couple of months :) There is a number of conceptual differences between MIG, GRR and OSquery. MIG does not retrieve data from endpoints, but instead focuses on answering yes/no questions. For example: find hosts that have a file in /var/www that contains the regex '12345'. MIG will run the search on all endpoints and return the location of files and hosts that match. But it won't return the files themselves. Privacy is preserved, but investigators need to manually retrieve files if needed. MIG takes this approach to keep the search very fast (parallel AMQP runs in seconds across thousands of endpoints). Retrieving data at large scale is too expensive for Mozilla (bandwidth, storage, execution time), and we like to protect privacy. I really like the SQL approach taken by osquery. I brainstormed something similar last year [1] but did not get around to it yet. SQL is very natural to use for a lot of IT/Security people, and it's great to be able to transfer that knowledge to search tools. GRR and OSquery are awesome tools. And I can tell their authors are solving some really hard problems. We're competing a bit, but it's OK to have multiple tools with varying goals. And it's great for borrowing each other's good ideas ;) [1] http://4u.1nw.eu/Presentation_workweek_20130916.pdf http://4u.1nw.eu/Presentation_workweek_20130916.pdf slides 10 & 11

by zobzu 12y ago

jvehent 12y ago

MIG author here. First, congrats to Mike Arpaia for shipping! That must have been a busy couple of months :) There is a number of conceptual differences between MIG, GRR and OSquery. MIG does not retrieve data from endpoints, but instead focuses on answering yes/no questions. For example: find hosts that have a file in /var/www that contains the regex '12345'. MIG will run the search on all endpoints and return the location of files and hosts that match. But it won't return the files themselves. Privacy is preserved, but investigators need to manually retrieve files if needed. MIG takes this approach to keep the search very fast (parallel AMQP runs in seconds across thousands of endpoints). Retrieving data at large scale is too expensive for Mozilla (bandwidth, storage, execution time), and we like to protect privacy. I really like the SQL approach taken by osquery. I brainstormed something similar last year [1] but did not get around to it yet. SQL is very natural to use for a lot of IT/Security people, and it's great to be able to transfer that knowledge to search tools. GRR and OSquery are awesome tools. And I can tell their authors are solving some really hard problems. We're competing a bit, but it's OK to have multiple tools with varying goals. And it's great for borrowing each other's good ideas ;) [1] http://4u.1nw.eu/Presentation_workweek_20130916.pdf http://4u.1nw.eu/Presentation_workweek_20130916.pdf slides 10 & 11