Osquery for Security Analysis

Osquery for Security Analysis将教您如何使用Osquery对网络上的主机进行全面调查。这不仅是Osquery教程，它还是一门旨在帮助您使用最适合该工作的工具来提高基于主机的调查技能的课程。

通常无法通过Internet进行通信的生产服务器表现出可疑的特征。它会将奇怪的网络流量突发发送到您一无所知的外部主机。流量已加密，因此网络数据将无济于事。您必须完全依靠基于主机的证据才能确定正在发生的事情。

MP4 | Video: h264, 1152×720 | Audio: AAC, 48000 Hz, 2 Ch
Language: English | Size: 1.07 GB | Duration: 5h 14m

Osquery for Security Analysis will teach you how to use Osquery to perform thorough investigations of hosts on your network. This isn’t just an Osquery tutorial, it’s a course designed to help you improve your host-based investigation skills using one of the best tools for the job.

A production server that doesn’t normally communicate over the internet is exhibiting suspicious characteristics. It’s sending out weird bursts of network traffic to an external host you don’t know anything about. The traffic is encrypted, so network data won’t be helpful. You have to rely exclusively on host-based evidence to figure out what’s happening.

Now be completely honest with yourself. Would you be able to come to a conclusion about whether an attack has occurred? Would you be able to do it quickly? Would you be 100% certain about your determination?

If you answered no to any of those, then you aren’t alone. The truth is, investigating things on the host is overwhelming. There are so many places to look: the registry, prefetch, disk artifacts, operating system logs…the list goes on.

The problem isn’t just the number of rabbit holes, its that each one requires a different tool to access and parse the data. A question as simple as “Did the malware execute after it was downloaded?” might require a combination of a dozen complicated and unmaintained open sources tools or a pricey commercial solution.

You’ll learn:

How to craft SQL queries to interrogate Windows, Linux, and MacOS hosts
Common queries for performing software inventory and asset control
Strategies for interrogating processes to determine if they are malicious
Techniques for uncovering persistence and lateral movement
Triaging suspicious systems using high-value data tables
Hunting leveraging MITRE ATT&CK techniques
Complete deployment of distributed Osquery across your network using Kolide Fleet and ElasticStack
How to leverage differential queries to monitor state changes and generate alerts
Extending Osquery with extensions