Skip to content

Latest commit

 

History

History
 
 

osquery Linux security event monitoring

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
 
 
 
 

Linux Security Event Monitoring with osquery

This talk introduces security event monitoring on Linux, and our lessons learned from attempts to implement it within osquery. Our first experience with osquery event monitoring was rewriting its use of the Audit subsystem. In order to capture events within containers, we next implemented an event publisher based on eBPF. We discovered what works, what doesn’t, and some paths forward.

Presented at

Resources

Author

  • Alessandro Gario