NoConName 2020 - Scaling detection with osquery + osctrl скачать в хорошем качестве

NoConName 2020 - Scaling detection with osquery + osctrl

Title: Scaling detection with osquery + osctrl Description: osquery (https://osquery.io) is an open source tool, originally developed by the Facebook Security team and currently managed by its own community as part of the Linux Foundation. It allows you to run a SQL engine on top of your operative system, and to use SQL queries to extract information about the health state and changes of the systems in your networks. This tool enhances the incident response capabilities of a Security team and it is important to understand the differences between the osquery shell (osqueryi) and the osquery daemon (osqueryd) and how to use them in a large enterprise network. In particular the remote API of osquery. Understanding well how the osquery remote API works is the first step to build scalable software around it. We will discuss the approach to go from just a few nodes to dozens of thousands while keeping everything working smoothly. None of the secret sauce is actually secret, since it’s still open source! A solution to enhance the detection capabilities of osquery is osctrl (https://osctrl.net), a fast and efficient osquery management solution, that implements its remote API as TLS endpoint, and allows to monitor, configure and interact with all your production or corporate assets, that use osquery as host instrumentation solution. osctrl has been used in corporate and production environments with thousands of nodes, thanks to its ability to scale and provide a reliable solution. Its particular architecture is key to scale, whether the environment is cloud, virtualized, container based or even bare metal. Original video: https://vimeo.com/513280928