How are teams currently using osquery?

Summary: Trail of Bits interviewed osquery users at five major tech firms a year after porting the open-source endpoint monitoring agent to Windows, finding deployment maturity varied from testing infrastructure to plans for a 17,500-machine rollout. Three of the five had osquery on production servers, though one rarely queried those endpoints over reliability and scalability concerns, and most used Chef or Puppet to deploy it.
Key Takeaway: Runaway queries on production fleets was a major concern for every company interviewed, even though no production performance incidents were reported - and one team's earlier performance incident had already mildly tarnished osquery's reputation internally.

Read the original at Trail of Bits Blog ↗