What do you wish osquery could do?
Summary: Trail of Bits asked osquery users what they wish the tool could do, and the answers included write-access to endpoints, automated incident response, and paying down technical debt. The post notes osquery is currently read-only, that a pull request enabling write-access through extensions is awaiting approval, and that some teams have already built rudimentary alerting by piping logs into ElasticSearch and auto-generating Jira tickets via ElastAlert.
Key Takeaway: Write-access would move osquery from detection into prevention, but the post warns that some users are only permitted to deploy it because of its read-only permissions, so the change carries real risk of system disruption. Facebook, which open sourced the tool, cannot satisfy the requests, leaving the community to fund development that individual organizations find uneconomical.
Read the original at Trail of Bits Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026