Cyber Risks · Trail of Bits Blog

Announcing osquery 5: Now with Endpoint Security on macOS

Summary: Trail of Bits announced osquery 5.0.1, which adds an EndpointSecurity-based es_process_events table for macOS, replacing the kernel-mode kauth and OpenBSM frameworks with a user-mode API that requires Apple-granted entitlements. The release installs osquery as an app bundle at /opt/osquery/lib/osquery.app with package identifier io.osquery.agent, and requires Full Disk Access under Apple's TCC framework, which can be granted silently via a PPPC configuration profile on MDM-enrolled Macs.

What's compelling: The EndpointSecurity integration required a new automated packaging and code-signing pipeline, which the article says finally lets Facebook's original osquery developers hand the project fully to the community - the same groundwork that could bring NetworkExtension and other entitled macOS monitoring frameworks into osquery.

Read the original at Trail of Bits Blog ↗