Kolide Osquery Workshop

Kolide, Inc.

<H2><IMG SRC="https://cdn.evbuc.com/eventlogos/239891385/zachwhiteboard2.jpg"></H2>
<H2>Due to the short notice of our announcement for the first session in October, we have decided to cancel the NYC workshop at this time. Please stay tuned as we will host this at a later date, with more time for people to prepare!</H2>
<H2><BR></H2>
<H2>Workshop - San Francisco, CA</H2>
<P><STRONG>When:</STRONG> <SPAN>Tuesday, November 13th</SPAN>, to <SPAN>Wednesday, November 14th</SPAN></P>
<P><SPAN><STRONG>Time:</STRONG> 8:30am - 5:00pm</SPAN></P>
<P><STRONG>Where: </STRONG><A HREF="https://goo.gl/maps/6TXhRGAGSCT2" TARGET="_blank" DATA-MSYS-CLICKTRACK="0" REL="nofollow noopener noreferrer">Union Square Harry M. Smith Conference Room</A>, 414 Mason St. 8th Floor, Suite 800, San Francisco, CA 94102</P>
<H2>Overview</H2>
<P><SPAN>This 2-day workshop is a crash course on everything related to osquery, with hands-on training with leading experts in the field. We will focus on providing background on what osquery is, why it is useful, who is using it, and how you can bring it to your organization. In addition to some deep dives on use cases and architecture, we will also be discussing Kolide Fleet: our open-source tool we built on top of osquery to maximize useability and integration.</SPAN></P>
<H2><SPAN>Who should take this course?</SPAN></H2>
<P><SPAN>This class is good for Security Researchers, Engineers, and technically-minded security leaders looking to evaluate osquery for endpoint management need, especially with a focus on detection and threat intelligence.</SPAN></P>
<H2><SPAN>Requirements</SPAN></H2>
<UL>
<LI>
<P><SPAN>Familiarity with basic operating system and security concepts</SPAN></P>
</LI>
<LI>
<P><SPAN>Ability to work with command line interfaces</SPAN></P>
</LI>
<LI>
<P><SPAN>Basic understanding of how system state impacts security of endpoints</SPAN></P>
</LI>
<LI>
<P><SPAN>No experience with osquery necessary (SQL experience helpful but not necessary)</SPAN></P>
</LI>
</UL>
<H2><SPAN>What should you bring?</SPAN></H2>
<P><SPAN>Windows, Mac, or Linux Laptop with at least 8GB of ram, and a power cord.</SPAN></P>
<H2><SPAN>What you will be provided.</SPAN></H2>
<P><SPAN>Breakfast, coffee, and lunch.</SPAN></P>
<P><SPAN>Certificate for completion of the course.</SPAN></P>
<P><SPAN>3-months free trial of Kolide Cloud for your entire fleet.</SPAN></P>
<P><SPAN>20% off of one future course.</SPAN></P>
<H2><SPAN>Trainer Information</SPAN></H2>
<P><SPAN>Zach Wasserman is a Co-founder and Principal Engineer at Kolide. He has been contributing to osquery since its inception in 2014. Prior to working at Kolide, Zach worked as a Software Engineer at Facebook, and has extensive experience as a programming lecturer, developer, and researcher at the University of Pennsylvania.</SPAN></P>
<P><A HREF="https://www.youtube.com/watch?v=Y3yN_DCU7IU" TARGET="_blank" DATA-MSYS-CLICKTRACK="0" REL="nofollow noopener noreferrer">https://www.youtube.com/watch?v=Y3yN_DCU7IU</A></P>
<P><A HREF="https://www.youtube.com/watch?v=ACqvBUmPWZQ" TARGET="_blank" DATA-MSYS-CLICKTRACK="0" REL="nofollow noopener noreferrer">https://www.youtube.com/watch?v=ACqvBUmPWZQ</A></P>
<P><SPAN>Twitter: </SPAN><A HREF="https://twitter.com/TheZachW" TARGET="_blank" DATA-MSYS-CLICKTRACK="0" REL="nofollow noopener noreferrer">@TheZachW</A></P>
<H2><SPAN>Syllabus</SPAN></H2>
<P><SPAN>Each of the below sections will include lecture and demonstration introducing the relevant </SPAN>concepts, followed by interactive exercises in which participants work with osquery and related tools (running in virtual machines or in the cloud) to learn how to carry out meaningful independent analysis.</P>
<H2><SPAN>Day 1 - Osquery Fundamentals</SPAN></H2>
<H3><SPAN>9:00am: Introductions</SPAN></H3>
<UL>
<LI>
<P>Introductions around the room</P>
</LI>
<LI>
<P>What is osquery? Who is using it?</P>
</LI>
<LI>
<P>Introduction to osquery SQL</P>
</LI>
</UL>
<H3><SPAN>Using osqueryi to investigate suspicious activity</SPAN></H3>
<UL>
<LI>
<P>A user complains that their laptop is behaving strangely. Maybe they shouldn’t have opened the attachment the other day from their “boss”?</P>
</LI>
<LI>
<P>Investigate process activity on an individual machine with osqueryi to interactively dig into what is going on</P>
</LI>
<LI>
<P>How can we differentiate malicious activity from regular activity?</P>
</LI>
</UL>
<H3><SPAN>Break: 5-10 minutes</SPAN></H3>
<H3><SPAN>Osqueryi as a daily tool</SPAN></H3>
<UL>
<LI>
<P>Taking advantage of osqueryi to answer common questions about the state of hosts</P>
</LI>
<LI>
<P>Using osqueryi as a component of scripting pipelines</P>
</LI>
</UL>
<H3><SPAN>Lunch</SPAN></H3>
<H3><SPAN>Using the osquery daemon</SPAN></H3>
<UL>
<LI>
<P>What capabilities do we get from osquery that differentiate it from osqueryi?</P>
</LI>
<LI>
<P>How can differential queries enable us to track state changes over time?</P>
</LI>
<LI>
<P>What about events that take place between runs of queries? Introduce the osquery events system.</P>
</LI>
<LI>
<P>Using decorators and other advanced features to output logs with more context</P>
</LI>
</UL>
<H3><SPAN>Diving deeper into the osquery architecture</SPAN></H3>
<UL>
<LI>
<P>Having a better understanding of the architecture of osquery can help us squeeze more power out of the system while minimizing our impacts on system performance.</P>
</LI>
<LI>
<P>Focus on the watchdog (for performance monitoring), RocksDB (osquery’s internal storage mechanism)</P>
</LI>
</UL>
<H3><SPAN>Break</SPAN></H3>
<H3><SPAN>Advanced osquery SQL</SPAN></H3>
<UL>
<LI>
<P>How can we combine data from osquery tables in interesting ways?</P>
</LI>
<LI>
<P>Explore JOINs, subqueries and other ways to construct queries for deeper analysis</P>
</LI>
<LI>
<P>Learn how to evaluate query performance with osquery tooling</P>
</LI>
</UL>
<H2><SPAN>Day 2 - Bringing the power to a Fleet</SPAN></H2>
<H3><SPAN>Introducing Kolide Fleet</SPAN></H3>
<UL>
<LI>
<P>Live queries!</P>
</LI>
<LI>
<P>Config management in Fleet</P>
</LI>
</UL>
<H3><SPAN>Break: 5-10 minutes</SPAN></H3>
<H3><SPAN>Integrating osquery logs into a logging pipeline</SPAN></H3>
<UL>
<LI>
<P>Explore how we can aggregate logs to track baselines and changes over time using osquery with an open source logging pipeline</P>
</LI>
<LI>
<P>Understand options for integrating with the logging pipeline already in place at your organization.</P>
</LI>
<LI>
<P>What are the logger plugin options?</P>
</LI>
</UL>
<H3><SPAN>Lunch</SPAN></H3>
<H3><SPAN>System auditing with osquery</SPAN></H3>
<UL>
<LI>
<P>Explore osquery’s advanced tools for system auditing</P>
</LI>
<LI>
<P>Learn to track file system changes with the osquery File Integrity Monitoring capabilities</P>
</LI>
<LI>
<P>Work with the linux audit logs to track advanced forensic features like process executions and system calls</P>
</LI>
</UL>
<H3><SPAN>Break: 5-10 minutes</SPAN></H3>
<H3><SPAN>Using extensions to integrate with custom data sources</SPAN></H3>
<UL>
<LI>
<P>Though there are over 200 tables in osquery, each organization may have individualized needs</P>
</LI>
<LI>
<P>Go over very small example extensions to understand how any data source can be exposed through the osquery SQL interface</P>
</LI>
</UL>

San Francisco

Thank you for registering! We look forward to seeing you at the workshop. If you have any questions, please reach out to the coordinator, Antigoni Sinanis: antigoni@kolide.co

Our {communityGuidelinesLink} describe the sort of content we prohibit on Eventbrite. If you suspect an event may be in violation, you can report it to us so we can investigate.

To report other categories of prohibited or illegal content, submit {link}

Ticket sales have ended

Kolide Osquery Workshop

More events from Kolide, Inc.

Discover more events from Kolide, Inc., from Science & Tech to other experiences you might love.

Still looking for the right event?

Explore all events in San Francisco and filter by date, category, and more to find the perfect fit.

Ticket sales have ended

Kolide Osquery Workshop

More events from Kolide, Inc.

Discover more events from Kolide, Inc., from Science & Tech to other experiences you might love.

You might also like...

Browse more events with different dates, prices, and formats to find your next great experience.

Still looking for the right event?

Explore all events in San Francisco and filter by date, category, and more to find the perfect fit.