It is also imporant to note that many components have a large
It is helpful to break these pieces out so we can examine them a bit, so I’ve written them out as Which leads to a lot of confusion about what systems are responsible for which actions. Several components are bundled together in a single installed application or endpoint agent, However, if broken into the pieces required toĪccomplish all this, it becomes a much more complex issue. The abstracted question reads something like this: This one single question is actually a very complex problem. Resoures, or 30% of a server’s capacity ends up being dedicated just to monitoring it. Users end up with 10 different agents on their endpoints sucking up tons of valuable system This is a really important point and something that security and IT teams alike often overlook. Matt also had one further criteria, which really resonated with me: I want to be all leanish, and not double up on my products Of knowledge that can make finding the answers quite daunting. Many times before, but they still remain extremely relevant and also encompase a huge body What struck me about these questions was that I’ve heard variations of them Or pushing DSC, and tailing the results of the LCM reported drift The question, from user was this: I am currently rolling out log consolidation with SIEM capabilities (splunk)Īnd it's truly unclear to me what the difference between Osquery andĬonfiguring splunk clients with scheduled powershell code? To decide how they will approach getting visibility into their servers or workstations. On a lot of the issues I see from people first coming to Osquery or trying
Over the weekend (actually two weeks ago now, since I started writing this) a question was posted in the Osquery slack channel which touched I suggest you start reading about 50% of the way down the page. Note: This is a fairly lengthy post, so if you’re just looking for the punchline,
0 kommentar(er)
