Sharvil Shah

Summary: Trail of Bits announced version 5.0.1 of osquery, a cross-platform, open-source endpoint visibility agent, with the release introducing an EndpointSecurity-based process events table for macOS. The post, by Sharvil Shah and dated November 10, 2021, describes the release as a milestone for the project and covers how EndpointSecurity was integrated into osquery.
Why it matters: osquery's move to an EndpointSecurity-based process events table on macOS changes what endpoint telemetry is available to the open-source tooling many security teams already run, so detection coverage built on the prior macOS data source may need re-examination.

Read the original at Trail of Bits Blog ↗