-
Book Overview & Buying
-
Table Of Contents
-
Feedback & Rating

Security Monitoring with Wazuh
By :

When it comes to threat hunting, we need in-depth visibility of endpoint activities and the ability to run queries to allow the threat hunter to retrieve IOCs, suspicious activities, and vulnerabilities in a given endpoint. Osquery is the ideal tool for this purpose. It helps threat hunters treat their entire IT infrastructure, including endpoints, as a structured database that can be queried using SQL-like commands. You can get real-time, detailed information about your systems with Osquery and keep an eye on them for signs of compromise. In this section, we will cover the following topics:
Osquery is an open-source tool built by Facebook in 2014. It converts the target operating system into a relational database and allows us to ask questions from the table using SQL queries containing things such as...