Channels
zwass
8 months agoAny osquery users also using (or considering) Falco?
(Asking because I'm wondering if it would be useful to build an integration with osquery and/or Fleet)- z
Zach Zeid
8 months agoI am struggling to think about the use case here, would that mean that Fleet would be acting as the ingestion point, but having no control over pushing down rules, etc.? - s
seph
8 months agoIt seems like an interesting question. As I understand it, falco gathers something like audit/kprobe/bpf events, and then does analysis on them. Would a hypothetical perfect-world integration look like:1. osquery has access to the falco alert stream? This feels weird and out of scope 2. osquery has access to the falco sensor data? This feels better approached via bpf tables, or a kprobe table 3. falco has access to osquery data? Feels akin to streamalert I really want there to be an interesting overlap, but I haven’t come up with it yet. zwass
8 months agoInitially I think it would be more like #1 -- osquery has access to other streams such as syslog, ASL, windows eventlog -- I wonder if it would be useful for osquery to be able to ship the Falco alerts into the same logging pipeline that folks already have set up. Additionally, if osquery is running on the container host, there are other tables that could have value.
#2 and #3 totally agreed it doesn't make much sense.
If I were to approach such a thing initially it might be an osquery extension in Go that just makes the Falco events available. I could also theoretically see Fleet being able to manage rules and that kinda thing, but it would be further down the line after proving out the idea that it's useful for logs generated by Falco to flow through that same logging pipeline.- w
wkleinhenz
8 months agoive been thinking about looking at falco most likely to replace auditd but i havent really had time to dig into it 
Jams
8 months ago#1 Would this option require deploying both osquery and Falco inside k8s pods?zwass
8 months agoIt would not need to run inside each pod. Both osquery and Falco would run on the host (or within a single container on the host).- s
seph
8 months agoMore data in structured format is interesting.
View count: 1