RSS Parrot

Osquery Handout – SQL Filtering

https://defensivedepth.com/2020/04/28/osquery-handout-sql-filtering/

Published: April 28, 2020 14:53

Filtering out unneeded / known-good data is a key component to security operations – this handout guides you through the use of the most common SQL filtering operators that you can use with osquery. Download here –>…

Osquery Handout – Query Performance

https://defensivedepth.com/2020/04/14/osquery-performance-tuning-monitoring/

Published: April 14, 2020 15:41

It’s easy to shoot yourself in the foot when scheduling new queries across your osquery endpoints – this new handout guides you through practical steps you can take to develop and test performant queries in the pre-deployment, deployment and…

Fleet – Breaking out the osquery API & Web UI

https://defensivedepth.com/2020/04/02/kolide-fleet-breaking-out-the-osquery-api-web-ui/

Published: April 2, 2020 15:15

Note: Kolide Fleet has been retired. FleetDM is a drop-in replacement that was forked from Kolide Fleet by the team over at FleetDM.com. FleetDM has replaced Kolide Fleet in Security Onion and in my osquery course and is what I now recommend for osquery…

Osquery For Security Analysis – Q1 2020 Update

https://defensivedepth.com/2020/03/22/osquery-for-security-analysis-q1-2020-update/

Published: March 22, 2020 18:08

I recently published a major update to my AND course, Osquery For Security Analysis. Lots of content updated, and lots of brand new content including the following: Deploying osquery with Kolide Launcher Generating custom osquery packages, deploying them…

Detecting Internet-Exposed Services (That shouldn’t be)

https://defensivedepth.com/2019/12/16/detecting-internet-exposed-services-that-shouldnt-be/

Published: December 16, 2019 18:53

I recently woke up to this email from Digital Ocean: Hi there, On December 4, 2019, we identified a bug in our systems that affected how Cloud Firewalls were applied to some Droplets. From November 20, 2019 until December 5, 2019, Cloud Firewall rules were…

Osquery – Enriching Chrome Extension Data

https://defensivedepth.com/2019/02/28/osquery-enriching-chrome-extension-data/

Published: February 28, 2019 14:23

I am always looking for ways to gain further context around data in order to make more effective decisions about whats actually going on. Last fall I was looking at the data provided by the chrome_extensions table – what other data could be used to provide…

Osquery – JOIN with Users table not returning results

https://defensivedepth.com/2019/02/21/osquery-join-with-users-table-not-returning-results/

Published: February 21, 2019 15:56

This is a question that I have seen asked many times (and yes, a few of those were me!): “I can’t figure out why my query isn’t working. `SELECT * FROM users JOIN chrome_extensions USING (uid);` works and returns the list of extensions, but `SELECT * FROM…

Logstash Parsing – Windows Event Logs shipped by osquery

https://defensivedepth.com/2018/12/21/logstash-parsing-windows-eventlogs-shipped-by-osquery/

Published: December 21, 2018 17:54

Did you know that you can ship Windows eventlogs with osquery? Just use the windows_events evented table, which by default, gets logs from the following channels: System, Security, and Application. This is configurable, so you can ship those awesome Sysmon…

Tag osquery logs with ATT&CK IDs

https://defensivedepth.com/2018/11/11/tag-osquery-logs-with-attck-ids/

Published: November 11, 2018 10:39

Just a quick tip: Tag your osquery queries/logs with @MITREattack IDs like so: SELECT username,shell, ‘T1136’ AS attckID FROM users;

Integrating Osquery Into Security Onion

https://defensivedepth.com/2018/10/19/integrating-osquery-into-security-onion/

Published: October 19, 2018 17:45

I recently presented at the 2018 Security Onion Conference, on “Integrating Osquery Into Security Onion.”  You can find the slide deck here [pdf]. The core of the presentation was focused on some basic integrations of osquery and Security Onion. The…