Any plan to integrate something like google rapid response

Question

Any plan to integrate something like google rapid response <https github com google grr> in OSQuery I would be amazing to get this type of functionality from osquery directly

alessandrogario · Answer

Seems like it is written in Python there is a Python SDK to connect to osquery and export tables and other plugins

alessandrogario · Answer

Additionally when implemented inside an extension a table plugin can support write access i e INSERT INTO UPDATE DELETE FROM

alessandrogario · Answer

We have already seen tables that can add remove firewall rules or kill processes

Ojas · Answer

But i dont wnna install 2 different agents If we can combine both agents that would be awesome

seph · Answer

They may be different projects with different goals What abilities from GRR would you add to osquery

Ojas · Answer

Hey < seph> It would be cool to get some of the below mentioned features Agent side Live remote memory analysis Powerful search and download capabilities for files OS level and raw file system access Detailed monitoring of client CPU memory IO usage and self imposed limits Sever side Fully fledged response capabilities handling most incident response and forensics tasks shutting down some app isolating machine from internet etc

seph · Answer

Osquery has many of those client features

seph · Answer

But osquery does not aim to control the machine So the core project will not gain thjnfs like shutdown or app isolation

seph · Answer

I think it would be interesting if someone added that kind of functionality to an extension