// HACKER NEWS — CYBERSECURITY
Production-ready detection and response queries for osquery
osquery queries for Detection & Incident Response, containing 250+ production-ready queries.
ODK (osquery-defense-kit) is unique in that the queries are designed to be used as part of a production detection & response pipeline. The detection queries are formulated to return zero rows during normal expected behavior, so that they may be configured to generate alerts when rows are returned.
At the moment, these queries are predominantly designed for execution on POSIX platforms (Linux & macOS). Pull requests to improve support on other platforms are fully welcome.
Run make detect for point-in-time detection. This will not detect as much as a production installation as it will not have access to historical events.
Download a released query pack into a convenient location, and point to these files from the packs stanza of your osquery.conf file
Run make collect. This is particularly useful for before/after analysis.
Run make packs. For more control, you can invoke osqtool directly, to override default intervals or exclude checks.
The detection queries are further divided up by MITRE ATT&CK tactics categories.
At release time, the queries are packed up in osquery query pack format. See Local Pack Generation for information on how to generate your own packs at any time.
https://cybersecurity.att.com/blogs/labs-research/shikitega-new-stealthy-malware-targeting-linux