Manage your fleet’s firewalls with osquery
Summary: Trail of Bits, in partnership with Airbnb, released an osquery extension that gives programmatic control over the native firewalls on Linux, Windows, and macOS through a common interface. The extension adds two writable tables, HostBlacklist and PortBlacklist, which generate entries via iptables, netsh, and pfctl respectively, letting an administrator block a host or port across a fleet with an INSERT statement.
Key Takeaway: The extension moves osquery from monitoring into prevention and recovery, so an administrator can block a malicious address or stop data egress across the whole fleet without deploying a separate firewall management service.
Read the original at Trail of Bits Blog ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026