Garret Reece
Summary: Trail of Bits released three osquery extensions in May 2018: one to manage local firewalls across fleets on the three major operating systems, one to manage Google Santa's macOS application whitelist and blacklist without a separate sync server, and one to collect NTFS filesystem forensic information for incident response and data collection. The NTFS extension is positioned as an alternative to forensics toolkits and commercial services that offer similar capabilities.
What's compelling: The NTFS extension is pitched as a way to dispense with commercial forensics toolkits and services, which puts a concrete cost and vendor decision in front of the team that owns incident response.
Read the original at Trail of Bits Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026