home.social

#osquery — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #osquery, aggregated by home.social.

  1. Rad Web Hosting | radwebhosting.com @[email protected] ·

    How to Install #Osquery on #Ubuntu #VPS This article provides a guide describing how to install Osquery on Ubuntu VPS. What is Osquery? Osquery is a lightweight, SQL-powered agent that lets you query your Linux system like a database. Need to list running processes, open ... Continued 👉

    How to Install Osquery on Ubun...

    #osquery #ubuntu #vps
  2. Rad Web Hosting @[email protected] ·

    How to Install #Osquery on #Ubuntu #VPS

    This article provides a guide describing how to install Osquery on Ubuntu VPS.
    What is Osquery?
    Osquery is a lightweight, SQL-powered agent that lets you query your Linux system like a database. Need to list running processes, open ports, installed packages, or detect file changes? You can do it all with plain SELECT statements and automate them on a schedule.

    Below is a production-ready, step-by-step guide ...
    Continued 👉 blog.radwebhosting.com/install

    #osquery #ubuntu #vps
  3. Matt Franz @[email protected] ·

    Wrote another #MCP server for fun github.com/mdfranz/osqueryi-mcp #osquery

    #mcp #osquery
  4. Rad Web Hosting @[email protected] ·

    How to Install #Osquery on #Ubuntu #VPS

    This article provides a guide describing how to install Osquery on Ubuntu VPS.
    What is Osquery?
    Osquery is a lightweight, SQL-powered agent that lets you query your Linux system like a database. Need to list running processes, open ports, installed packages, or detect file changes? You can do it all with plain SELECT statements and automate them on a schedule.

    Below is a production-ready, step-by-step guide ...
    Continued 👉 blog.radwebhosting.com/install

    #osquery #ubuntu #vps
  5. Rad Web Hosting @[email protected] ·

    How to Install #Osquery on #Ubuntu #VPS

    This article provides a guide describing how to install Osquery on Ubuntu VPS.
    What is Osquery?
    Osquery is a lightweight, SQL-powered agent that lets you query your Linux system like a database. Need to list running processes, open ports, installed packages, or detect file changes? You can do it all with plain SELECT statements and automate them on a schedule.

    Below is a production-ready, step-by-step guide ...
    Continued 👉 blog.radwebhosting.com/install

    #osquery #ubuntu #vps
  6. Rad Web Hosting @[email protected] ·

    How to Install #Osquery on #Ubuntu #VPS

    This article provides a guide describing how to install Osquery on Ubuntu VPS.
    What is Osquery?
    Osquery is a lightweight, SQL-powered agent that lets you query your Linux system like a database. Need to list running processes, open ports, installed packages, or detect file changes? You can do it all with plain SELECT statements and automate them on a schedule.

    Below is a production-ready, step-by-step guide ...
    Continued 👉 blog.radwebhosting.com/install

    #osquery #ubuntu #vps
  7. Rad Web Hosting @[email protected] ·

    How to Install #Osquery on #Ubuntu #VPS

    This article provides a guide describing how to install Osquery on Ubuntu VPS.
    What is Osquery?
    Osquery is a lightweight, SQL-powered agent that lets you query your Linux system like a database. Need to list running processes, open ports, installed packages, or detect file changes? You can do it all with plain SELECT statements and automate them on a schedule.

    Below is a production-ready, step-by-step guide ...
    Continued 👉 blog.radwebhosting.com/how-to-

    #osquery #ubuntu #vps
  8. Josh Lemon @[email protected] ·

    Memory Analysis for #Linux has always been a bit hit-or-miss. Trail of Bits has released a tool called #mquire that doesn't require debug symbols for the originating Kernel.

    It also uses SQL-based queries to perform analysis, similar to #OSquery.

    blog.trailofbits.com/2026/02/2

    #MemoryForensics #IncidentResponse #DFIR #DigitalForensics

    #linux #mquire #osquery #memoryforensics #incidentresponse #dfir
  9. Josh Lemon @[email protected] ·

    Memory Analysis for #Linux has always been a bit hit-or-miss. Trail of Bits has released a tool called #mquire that doesn't require debug symbols for the originating Kernel.

    It also uses SQL-based queries to perform analysis, similar to #OSquery.

    blog.trailofbits.com/2026/02/2

    #MemoryForensics #IncidentResponse #DFIR #DigitalForensics

    #linux #mquire #osquery #memoryforensics #incidentresponse #dfir
  10. Josh Lemon @[email protected] ·

    Memory Analysis for #Linux has always been a bit hit-or-miss. Trail of Bits has released a tool called #mquire that doesn't require debug symbols for the originating Kernel.

    It also uses SQL-based queries to perform analysis, similar to #OSquery.

    blog.trailofbits.com/2026/02/2

    #MemoryForensics #IncidentResponse #DFIR #DigitalForensics

    #linux #mquire #osquery #memoryforensics #incidentresponse #dfir
  11. Josh Lemon @[email protected] ·

    Memory Analysis for #Linux has always been a bit hit-or-miss. Trail of Bits has released a tool called #mquire that doesn't require debug symbols for the originating Kernel.

    It also uses SQL-based queries to perform analysis, similar to #OSquery.

    blog.trailofbits.com/2026/02/2

    #MemoryForensics #IncidentResponse #DFIR #DigitalForensics

    #digitalforensics #dfir #incidentresponse #memoryforensics #osquery #mquire
  12. Josh Lemon @[email protected] ·

    Memory Analysis for #Linux has always been a bit hit-or-miss. Trail of Bits has released a tool called #mquire that doesn't require debug symbols for the originating Kernel.

    It also uses SQL-based queries to perform analysis, similar to #OSquery.

    blog.trailofbits.com/2026/02/2

    #MemoryForensics #IncidentResponse #DFIR #DigitalForensics

    #linux #mquire #osquery #memoryforensics #incidentresponse #dfir
  13. Rad Web Hosting @[email protected] ·

    How to Install #Osquery on #Ubuntu #VPS

    This article provides a guide describing how to install Osquery on Ubuntu VPS.
    What is Osquery?
    Osquery is a lightweight, SQL-powered agent that lets you query your Linux system like a database. Need to list running processes, open ports, installed packages, or detect file changes? You can do it all with plain SELECT statements and automate them on a schedule.

    Below is a production-ready, step-by-step guide ...
    Continued 👉 blog.radwebhosting.com/how-to-

    #osquery #ubuntu #vps
  14. Rad Web Hosting @[email protected] ·

    How to Install #Osquery on #Ubuntu #VPS

    This article provides a guide describing how to install Osquery on Ubuntu VPS.
    What is Osquery?
    Osquery is a lightweight, SQL-powered agent that lets you query your Linux system like a database. Need to list running processes, open ports, installed packages, or detect file changes? You can do it all with plain SELECT statements and automate them on a schedule.

    Below is a production-ready, step-by-step guide ...
    Continued 👉 blog.radwebhosting.com/how-to-

    #osquery #ubuntu #vps
  15. Rad Web Hosting @[email protected] ·

    How to Install #Osquery on #Ubuntu #VPS

    This article provides a guide describing how to install Osquery on Ubuntu VPS.
    What is Osquery?
    Osquery is a lightweight, SQL-powered agent that lets you query your Linux system like a database. Need to list running processes, open ports, installed packages, or detect file changes? You can do it all with plain SELECT statements and automate them on a schedule.

    Below is a production-ready, step-by-step guide ...
    Continued 👉 blog.radwebhosting.com/how-to-

    #osquery #ubuntu #vps
  16. Rad Web Hosting @[email protected] ·

    How to Install #Osquery on #Ubuntu #VPS

    This article provides a guide describing how to install Osquery on Ubuntu VPS.
    What is Osquery?
    Osquery is a lightweight, SQL-powered agent that lets you query your Linux system like a database. Need to list running processes, open ports, installed packages, or detect file changes? You can do it all with plain SELECT statements and automate them on a schedule.

    Below is a production-ready, step-by-step guide ...
    Continued 👉 blog.radwebhosting.com/how-to-

    #osquery #ubuntu #vps
  17. Rad Web Hosting @[email protected] ·

    How to Install #Osquery on #Ubuntu #VPS

    This article provides a guide describing how to install Osquery on Ubuntu VPS.
    What is Osquery?
    Osquery is a lightweight, SQL-powered agent that lets you query your Linux system like a database. Need to list running processes, open ports, installed packages, or detect file changes? You can do it all with plain SELECT statements and automate them on a schedule.

    Below is a production-ready, step-by-step guide ...
    Continued 👉 blog.radwebhosting.com/how-to-

    #osquery #ubuntu #vps
  18. Rad Web Hosting @[email protected] ·

    How to Install #Osquery on #Ubuntu #VPS

    This article provides a guide describing how to install Osquery on Ubuntu VPS.
    What is Osquery?
    Osquery is a lightweight, SQL-powered agent that lets you query your Linux system like a database. Need to list running processes, open ports, installed packages, or detect file changes? You can do it all with plain SELECT statements and automate them on a schedule.

    Below is a production-ready, step-by-step guide ...
    Continued 👉 blog.radwebhosting.com/how-to-

    #osquery #ubuntu #vps
  19. Rad Web Hosting @[email protected] ·

    How to Install #Osquery on #Ubuntu #VPS

    This article provides a guide describing how to install Osquery on Ubuntu VPS.
    What is Osquery?
    Osquery is a lightweight, SQL-powered agent that lets you query your Linux system like a database. Need to list running processes, open ports, installed packages, or detect file changes? You can do it all with plain SELECT statements and automate them on a schedule.

    Below is a production-ready, step-by-step guide ...
    Continued 👉 blog.radwebhosting.com/how-to-

    #osquery #ubuntu #vps
  20. Rad Web Hosting @[email protected] ·

    How to Install #Osquery on #Ubuntu #VPS

    This article provides a guide describing how to install Osquery on Ubuntu VPS.
    What is Osquery?
    Osquery is a lightweight, SQL-powered agent that lets you query your Linux system like a database. Need to list running processes, open ports, installed packages, or detect file changes? You can do it all with plain SELECT statements and automate them on a schedule.

    Below is a production-ready, step-by-step guide ...
    Continued 👉 blog.radwebhosting.com/how-to-

    #osquery #ubuntu #vps
  21. Rad Web Hosting @[email protected] ·

    How to Install #Osquery on #Ubuntu #VPS

    This article provides a guide describing how to install Osquery on Ubuntu VPS.
    What is Osquery?
    Osquery is a lightweight, SQL-powered agent that lets you query your Linux system like a database. Need to list running processes, open ports, installed packages, or detect file changes? You can do it all with plain SELECT statements and automate them on a schedule.

    Below is a production-ready, step-by-step guide ...
    Continued 👉 blog.radwebhosting.com/how-to-

    #osquery #ubuntu #vps
  22. Rad Web Hosting @[email protected] ·

    How to Install #Osquery on #Ubuntu #VPS

    This article provides a guide describing how to install Osquery on Ubuntu VPS.
    What is Osquery?
    Osquery is a lightweight, SQL-powered agent that lets you query your Linux system like a database. Need to list running processes, open ports, installed packages, or detect file changes? You can do it all with plain SELECT statements and automate them on a schedule.

    Below is a production-ready, step-by-step guide ...
    Continued 👉 blog.radwebhosting.com/how-to-

    #osquery #ubuntu #vps
  23. Rad Web Hosting @[email protected] ·

    How to Install #Osquery on #Ubuntu #VPS

    This article provides a guide describing how to install Osquery on Ubuntu VPS.
    What is Osquery?
    Osquery is a lightweight, SQL-powered agent that lets you query your Linux system like a database. Need to list running processes, open ports, installed packages, or detect file changes? You can do it all with plain SELECT statements and automate them on a schedule.

    Below is a production-ready, step-by-step guide ...
    Continued 👉 blog.radwebhosting.com/how-to-

    #osquery #ubuntu #vps
  24. Habr @[email protected] ·

    Fleet&Osquery — швейцарский нож для ИБ, или Как мы сами себя успешно ддосили

    Всем привет, меня зовут Денис, и я старший инженер инфраструктурной безопасности в Ozon. Эта статья — продолжение цикла про osquery и Fleet. Предыдущие статьи вы можете почитать здесь и здесь . В статье хочу поделиться радостью и «болью» опыта эксплуатации связки Fleet и osquery в масштабе e-commerce/highload. Этот опыт будет полезен тем, кто ещё только думает об этой связке и планирует её внедрять, а также тем, кто уже внедрил и эксплуатирует. Osquery мы эксплуатируем на рабочих станциях и серверах под управлением операционных систем MacOS, Windows и Linux. Для начала стоит напомнить, что такое osquery и Fleet и почему они так классно друг друга дополняют. Osquery — opensource, написанный на С++, представляет собой агента, запущенного на хостовой (и не только) ОС, который может предоставить большое количество информации о вашей системе и событиях в виде СУБД. Также osquery имеет два вида запросов:

    habr.com/ru/companies/ozontech

    #fleetdm #fleet #osquery #opensource

    #fleetdm #fleet #osquery #opensource
  25. Frank Paul Silye @[email protected] ·

    This is an awesome product! And it is getting better and better with every single release...
    #OpenSource #GitOps #MDM #FleetDM #Osquery

    RE: discuss.systems/@Fleet/1141631

    #opensource #gitops #mdm #fleetdm #osquery
  26. Javier Marcos 🔐 @[email protected] ·

    #osctrl 0.3.6 is released! Updates of dependencies, bug fixes and more stability. Complete rewrite of SAML/SSO authentication and more: github.com/jmpsec/osctrl/relea #detection #infrastructure #security #osquery #DFIR #Compliance #linux #IT

    #osctrl #detection #infrastructure #security #osquery #dfir
  27. pezhore @[email protected] ·

    Does anyone have up to date info on how to use #SecurityOnion with #OSQuery ? The only mention in Seconion 2.4 docs is an unhelpful "The link takes you to Kibana".

    Earlier documentation had detailed steps for generating client installers, how to enable the service through so-allow... Now all of that is gone.

    #InfoSec #OSS #OSSInfoSec #kibana

    #securityonion #osquery #infosec #oss #ossinfosec #kibana
  28. Recon InfoSec @[email protected] ·

    Learn #Osquery file access monitoring at #ThursdayDefensive (12:30CT) with Chris Long. Join us! reconinfosec.com/thursday-defe #cybersecurity

    #osquery #thursdaydefensive #cybersecurity
  29. Gilles Gagniard @[email protected] ·

    While reading on the latest #noabot #malware currently in the news akamai.com/blog/security-resea and more particularly how to detect its presence github.com/akamai/akamai-secur, I've discovered the very neat #osquery tool osquery.io/.

    I'm impressed how easy and expressive SQL queries can be run in parallel on all my servers to query packages/configuration items/users etc ...

    It's now installed everywhere 😉

    #noabot #malware #osquery
  30. Aaron Ash @[email protected] ·

    Fun afternoon project: #Fuse mount #osquery tables as json and apache #arrow dataframes:
    github.com/AshyIsMe/dffs

    #fuse #osquery #arrow
  31. Jessica D Dooley @[email protected] ·

    Starting a sentence with "Know that..." in #documentation is both efficient and a power move, I'm here for it.

    #osquery

    #documentation #osquery
  32. grep_security @[email protected] ·

    Maximizing Threat Detections of Qakbot with #Osquery

    research.loginsoft.com/threat-

    #threatintel #threathunting #dfir #qakbot #infosec

    #osquery #threatintel #threathunting #dfir #qakbot #infosec
  33. Thomas Strömberg @[email protected] ·

    This is a fun way to detect #bpfdoor and other minimalist #posix #malware using #osquery

    > SELECT * FROM process_open_sockets WHERE fd=0 AND NOT (family = 1 AND protocol = 0);

    It traverses /proc to find processes where the first file descriptor (typically stdin) is a socket — excluding local UNIX domain sockets as some legit programs do that.

    This sounds like an unlikely detector, but I've only seen backdoors like #bpfdoor behave this way.

    From unfinished.bike/fun-with-the-n

    #osquery #malware #posix #bpfdoor
  34. Thomas Strömberg @[email protected] ·

    This is a fun way to detect #bpfdoor and other minimalist #posix #malware using #osquery

    > SELECT * FROM process_open_sockets WHERE fd=0 AND NOT (family = 1 AND protocol = 0);

    It traverses /proc to find processes where the first file descriptor (typically stdin) is a socket — excluding local UNIX domain sockets as some legit programs do that.

    This sounds like an unlikely detector, but I've only seen backdoors like #bpfdoor behave this way.

    From unfinished.bike/fun-with-the-n

    #osquery #malware #posix #bpfdoor
  35. Thomas Strömberg @[email protected] ·

    This is a fun way to detect #bpfdoor and other minimalist #posix #malware using #osquery

    > SELECT * FROM process_open_sockets WHERE fd=0 AND NOT (family = 1 AND protocol = 0);

    It traverses /proc to find processes where the first file descriptor (typically stdin) is a socket — excluding local UNIX domain sockets as some legit programs do that.

    This sounds like an unlikely detector, but I've only seen backdoors like #bpfdoor behave this way.

    From unfinished.bike/fun-with-the-n

    #osquery #malware #posix #bpfdoor
  36. Thomas Strömberg @[email protected] ·

    This is a fun way to detect #bpfdoor and other minimalist #posix #malware using #osquery

    > SELECT * FROM process_open_sockets WHERE fd=0 AND NOT (family = 1 AND protocol = 0);

    It traverses /proc to find processes where the first file descriptor (typically stdin) is a socket — excluding local UNIX domain sockets as some legit programs do that.

    This sounds like an unlikely detector, but I've only seen backdoors like #bpfdoor behave this way.

    From unfinished.bike/fun-with-the-n

    #bpfdoor #posix #malware #osquery
  37. Thomas Strömberg @[email protected] ·

    This is a fun way to detect #bpfdoor and other minimalist #posix #malware using #osquery

    > SELECT * FROM process_open_sockets WHERE fd=0 AND NOT (family = 1 AND protocol = 0);

    It traverses /proc to find processes where the first file descriptor (typically stdin) is a socket — excluding local UNIX domain sockets as some legit programs do that.

    This sounds like an unlikely detector, but I've only seen backdoors like #bpfdoor behave this way.

    From unfinished.bike/fun-with-the-n

    #osquery #malware #posix #bpfdoor
  38. Thomas Strömberg @[email protected] ·

    #osquery defense kit v1.6.0 just dropped with some new #blueteam queries: github.com/chainguard-dev/osqu

    - unencrypted #GCP service account keys
    - unexpected #sysctl calls
    - unexpected #xattr calls
    - unexpected file made #executable
    - unexpected Security.Framework program

    If nothing else, I hope the queries are useful ideas for others! Have a great weekend. 🌴

    #executable #xattr #sysctl #gcp #blueteam #osquery
  39. grep_security @[email protected] ·

    Hey #soc and #blueteam, if I have to hunt for #mimikatz executed from #cobaltstrike using #osquery, what are the tables I need to correlate? Though I figured out few events from security logs, I want to use OSQUERY logs for hunting. Any suggestions?

    #threathunting #threatintel

    #soc #blueteam #mimikatz #cobaltstrike #osquery #threathunting
  40. Thomas Strömberg @[email protected] ·

    New Linux #malware, focused on IoT: fortinet.com/blog/threat-resea

    The #osquery rules we've open-sourced at github.com/chainguard-dev/osqu already have your back.

    Here are the alerts that will fire when a node is infected with #RapperBot:

    - hidden-executable
    - unexpected-exec-dir
    - sketchy-fetchers
    - unexpected-executable-permissions
    - unexpected-talkers

    #rapperbot #osquery #malware
  41. Hubert Dulay @[email protected] ·

    #osquery is so fun and easy because it's #sql . Here's how to get started with #decodable ! github.com/decodableco/example

    #decodable #sql #osquery