Facebook's osquery

I just came across this last week and thought it looked interesting. I guess it has been out for over a year and I want to know if anyone else has deployed this in dev, tst, or prd environments?

https://osquery.readthedocs.io/en/stable/

Find more posts tagged with

Comments

Verities

That's an impressive free tool, nice documentation, and even addresses the first thing I thought of..performance:

"The osquery tooling provides a full-featured profiling script. The script can evaluate table, query, and scheduled query performance on a system. Before scheduling a set of queries on your enterprise hosts, it is best practice to measure the expected performance impact"

I'll have to try this out next week. Thanks for posting this.

alias454

Did you ever get a chance to play around? I finally got a system stood up and can see some opportunities. I already sold a couple of the other admins on some ideas so now I have to develop a poc.

Verities

No...I forgot about it. I'm glad you resurrected this because I still want to see how useful it is.