osquery
osquery is an operating system instrumentation framework by Facebook and written in C++, that supports Windows, Linux, OS X (macOS), and other operating systems. It provides an interface to query an operating system using an SQL like syntax. By using this, we can perform low-level activities such as running processes, kernel configurations, network connections, and file integrity checks. Overall it's like a host-based intrusion detection system (HIDS) endpoint security. It provides osquery as a service, system interactive shell, and so on. Hence we can use this to perform centralized monitoring and security management solutions. Read more about osquery at https://osquery.io.
Here is a high-level overview of what osquery looks like: ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access