bsidesaustin2019

Facebook's cross-platform osquery agent is increasingly being used by security professionals to monitor assets from the lab to the enterprise. Anyone who has tried an osquery configuration and then deployed it to a production server can attest to how easy it can be to shoot yourself in the foot. The presenter breaks down the architectural challenges, lessons learned, and best practices. Then there's the fact that the last functional osquery release was in August 2018, and Facebook' move to internal tools (Buck, Phabricator) has caused a stir. If you rely on osquery in your infrastructure, or have a desire to do so, you will want to attend and come armed with your own questions.