Osquery - Core Threads

Channels

Topic	Authors	Views	Replies	Activity
Has anyone tried parsing Windows sdb files with osquery? For example, `windir%\security\database\secedit.sdb` , which stores local policy configuration (password complexity requirements, etc) Unfortunately its contents ...	s	1	3	4 days ago
Hrm. As I tinkering around m1 things, I think we made it hard. We have pretty comprehensive support for platforms. They’re in the schema, we expose a bitfield of them. Etc. But we don’t expose any kind of architecture i...	s	1	3	1 week ago
Does anyone have a sense of where most of the resource utilization in osquery comes from when using event-based tables with a high volume of events? Is it in the RocksDB read/write?	a	12	3	1 month ago
Anyhow for ^^^?	s	1	2	1 month ago
Thumbs for https://github.com/osquery/osquery/pull/7427 (It’s a tiny one, was approved, but typo changes invalidated the approval)	s	7	2	1 month ago
I’ll write up a CHANGELOG later	s	9	2	2 months ago
After discussion, we cut a 5.2.3 release. https://github.com/osquery/osquery/releases/5.2.3 exists. Take a look folks!	j	5	2	2 months ago
How close is https://github.com/osquery/osquery/pull/7549 ?	a	2	2	2 months ago
Ok, verified that the signatures work as expected locally, I've updated the secrets for our build process, so we should be all set for the next release.		1	3	2 months ago
Hi, I'm interested working on this issue: https://github.com/osquery/osquery/issues/7463. I'm wondering If it's a way fetching the data from other way in order to support more distributions. I found that i can execute ...	s	5	2	3 months ago

Has anyone tried parsing Windows sdb files with osquery? For example,
windir%\security\database\secedit.sdb
, which stores local policy configuration (password complexity requirements, etc) Unfortunately its contents ...
3 Replies
4 days ago
s
Hrm. As I tinkering around m1 things, I think we made it hard. We have pretty comprehensive support for platforms. They’re in the schema, we expose a bitfield of them. Etc. But we don’t expose any kind of architecture i...
3 Replies
1 week ago
Does anyone have a sense of where most of the resource utilization in osquery comes from when using event-based tables with a high volume of events? Is it in the RocksDB read/write?
3 Replies
1 month ago
s
Anyhow for ^^^?
2 Replies
1 month ago
s
Thumbs for https://github.com/osquery/osquery/pull/7427 (It’s a tiny one, was approved, but typo changes invalidated the approval)
2 Replies
1 month ago
s
I’ll write up a CHANGELOG later
2 Replies
2 months ago
s
After discussion, we cut a 5.2.3 release. https://github.com/osquery/osquery/releases/5.2.3 exists. Take a look folks!
2 Replies
2 months ago
s
How close is https://github.com/osquery/osquery/pull/7549 ?
2 Replies
2 months ago
Ok, verified that the signatures work as expected locally, I've updated the secrets for our build process, so we should be all set for the next release.
3 Replies
2 months ago
i
Hi, I'm interested working on this issue: https://github.com/osquery/osquery/issues/7463. I'm wondering If it's a way fetching the data from other way in order to support more distributions. I found that i can execute ...
2 Replies
3 months ago