Endpoint visibility with osquery
You query the operating system like a database with SQL and regularly watch processes, listening ports, users and persistence points across the fleet.
Level 301 · 15 lessons · 15 practice labs
Lessons
Basics
- The osquery idea: the OS as a set of tables
- Exploring tables with osqueryi
- Joining tables: process, port and file
- Short task: find running processes whose file was deleted from disk
Security queries
- Users, SSH authorised keys and sudoers
- Persistence: cron, systemd units, start-up scripts
- Listening and outbound-connecting processes
- File integrity events with osquery
- Short task: find three persistence points an attacker added
The fleet
- osqueryd, scheduled queries and packs
- Differential results: seeing only what changed
- Live queries with a fleet manager
- Sending results to the SIEM
- Short task: watch for newly opened ports across the fleet every hour
Capstone
- Capstone: build a fleet-wide security monitoring pack with osquery
Practice labs
- List listening ports with their processes in osqueryi: Write a query joining listening_ports and processes and find the unexpected service.
- Find a running process whose file was deleted from disk: Use the on_disk field in the processes table to find the process running from a deleted binary.
- Join process, port and file hash in a single query: Pull the binary hash of every listening process from the hash table and compare it with the known-bad list.
- Find the unauthorised SSH key: List every key with its user from the authorized_keys table and find the one not on the approved list.
- Find the cron and systemd persistence an attacker added: Query the crontab and systemd_units tables and find two entries running from a temporary folder.
- Find the unexpected process connecting out: List processes connected to external addresses with process_open_sockets and find the shell running under the web server.
- Find a hidden privilege grant in sudoers and groups: Query the sudoers and user_groups tables together to find the unexpected fully privileged user.
- Catch a changed config file from file events: Configure file_events for /etc, trigger a change and match the event to the process that made it.
- Write a scheduled query pack: Define a pack that collects listening ports every hour and show the output in the osqueryd results log.
- See only newly opened ports with differential results: Read the differential output, find the newly added row and note which machine opened it.
- Search for a suspicious file across the fleet with a live query: Run a live query across every machine for the file with a given hash and list the machines where it is found.
- Ship query results to the SIEM in a usable format: Forward the results log as JSON, map the field names and query the new-port event in the SIEM.
- Find and fix the heavy query that slows machines down: Find the most expensive query in osquery_schedule statistics, reduce its interval and scope and compare the load.
- Find out why the process events table is empty: Check the osquery flags and the audit subsystem setting, turn event collection on and show rows arriving in process_events.
- Run the same query on three machines and compare the results: Send a listening-ports query to three machines from the fleet manager and find the port that is open on only one of them.
About this course
You query the operating system like a database with SQL and regularly watch processes, listening ports, users and persistence points across the fleet.
What you will learn
- Basics
- Security queries
- The fleet
- Capstone
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.