Subject: [sacm] Knowledge sharing between SACM and OSQuery

From: Sherif Mansour Farag <[email-masked]>
Date: Sat, 11 Feb 2017 09:37:11 +0000

Apologies if you have already see this but has anyone reached out to OSQuery.io<http://OSQuery.io> ? It's an open source solution created by Facebook to address some of the same challenges we are trying to slove. Might be worth exchanging notes at the very least.

OSQuery provides Performant Endpoint Visibility:
osquery allows you to easily ask questions about your Linux, Windows, and OS X infrastructure. Whether your goal is intrusion detection, infrastructure reliability, or compliance, osquery gives you the ability to empower and inform a broad set of organizations within your company.

The syntax is SQL-like, example:
osquery> SELECT uid, name FROM listening_ports l, processes p WHERE l.pid=p.pid;

Here is a list of signals they can pull from an endpoint:
https://osquery.io/docs/tables/

And here are some "pre-canned" queries they have released:
https://osquery.io/docs/packs/

They are really nice BTW and I have asked them to include container introspection as well. The plan is to have that done in the next couple of weeks.

-Sherif

---

From: Jerome Athias <[email-masked]>
Date: Sat, 11 Feb 2017 16:02:10 +0300

Sherif,

I get your point...
It's one 'implementation' (one cool technical tool, easy to use by
technicians, that just 'works'). Probably very cool and powerful, yes
(and we need things like this)
However...

This is (still/again) not based on a proper Ontology. (but can help to
complete one)
Leading to another Language, a non mature/structured, nor strict, 'data model'
e.g.: redundancy in the "sql schema", very simple types, etc.
(I'm not objective there, but the SQL-like approach is interesting* :p)

Yet for sure it's interesting, but MUST use (and may be used to
complete) more structured/mature data models for providing improved
Interoperability (and covering more use cases) for better Automation
(especially M2M).

That would help if they could use/improve something more structured
like MILE or OASIS CTI CybOX objects Models
Ref. https://cyboxproject.github.io/documentation/objects/ (not latest
version... but hopefully illustrates the point)
That would help to leverage the tool (as an embedded data model) in a
more global (interoperable/compatible) and efficient Model/Ontology.
* e.g.: https://github.com/athiasjerome/XORCISM/tree/master/MODELS

On Sat, Feb 11, 2017 at 12:37 PM, Sherif Mansour Farag
<[email-masked]> wrote:
> Apologies if you have already see this but has anyone reached out to
> OSQuery.io ? It's an open source solution created by Facebook to address
> some of the same challenges we are trying to slove. Might be worth
> exchanging notes at the very least.
>
> osquery allows you to easily ask questions about your Linux, Windows, and OS
> X infrastructure. Whether your goal is intrusion detection, infrastructure
> reliability, or compliance, osquery gives you the ability to empower and
> inform a broad set of organizations within your company.
>
> They are really nice BTW and I have asked them to include container
> introspection as well. The plan is to have that done in the next couple of
> weeks.
>
> -Sherif
>
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm
>

---

From: Sherif Mansour Farag <[email-masked]>
Date: Sat, 11 Feb 2017 13:16:40 +0000

Hi Jason,
Agree completely at the very most I' suggesting that both teams exchange notes I think it might be worth it. I.e. We get some pointers on prodictionised and a battle hardened solution vs. What would be the ideal.

I think it would be benifitical to talk to get their info in the challenges they faced vs. Some of the long term issues we are trying to solve for.

Also some rfc's codefied what is already out there vs. What has been agreed (cookies come to mind), not suggesting that will happen, but it does pay to look at how other have solved & implemented some of these challenges.

Knowledge sharing never hurt.
Who knows they might be the first team to implement sacm in full.

-Sherif
________________________________
From: Jerome Athias <[email-masked]>
Sent: Saturday, February 11, 2017 3:02:10 PM
To: Sherif Mansour Farag
Cc: [email-masked]
Subject: Re: [sacm] Knowledge sharing between SACM and OSQuery

Sherif,

I get your point...

---

From: Jerome Athias <[email-masked]>
Date: Sat, 11 Feb 2017 16:55:55 +0300

Sure

On Sat, Feb 11, 2017 at 4:16 PM, Sherif Mansour Farag <
[email-masked]> wrote:

> Hi Jason,
> Agree completely at the very most I' suggesting that both teams exchange
> notes I think it might be worth it. I.e. We get some pointers on
> prodictionised and a battle hardened solution vs. What would be the ideal.
>
> I think it would be benifitical to talk to get their info in the
> challenges they faced vs. Some of the long term issues we are trying to
> solve for.
>
> Also some rfc's codefied what is already out there vs. What has been
> agreed (cookies come to mind), not suggesting that will happen, but it does
> pay to look at how other have solved & implemented some of these challenges.
>
> ------------------------------
> *From:* Jerome Athias <[email-masked]>
> *Sent:* Saturday, February 11, 2017 3:02:10 PM
> *To:* Sherif Mansour Farag
> *Cc:* [email-masked]
> *Subject:* Re: [sacm] Knowledge sharing between SACM and OSQuery
>
> Sherif,
>
> I get your point...