Kolide & OSQuery - How to build solid queries & packs for incident detection & threat hunting

Monday, 15 Oct 2018 1:00PM EDT (15 Oct 2018 17:00 UTC)
Speakers: Stephen Sims, Erik Van Buggenhout

OSQuery is an amazing (free!) tool that can collect a wide variety of information from your environment. In a previous webcast, we explained some OSQuery basics and demonstrated a few queries. In this next webcast, we will go a step further and introduce how Kolide can be used to manage OSQuery in an enterprise environment. We will also discuss some more advanced query development techniques, which can help further enrich collected data and provide crucial insights on your environment. OSQuery & Kolide are covered in-depth during the course SEC599: Defeating Advanced Adversaries: Purple Team Tactics & Kill Chain Defenses.

Login to Register

Related Content

Cybersecurity and IT Essentials, Cybersecurity Insights

October 24, 2024

The ABCs of Cybersecurity

A glossary of cybersecurity terminology that will help you quickly get up to speed on the industry’s terms and meanings.

New2Cyber_-_Blog_-_CyberSecurity_Expertise_where_should_you_begin_-_2.jpg

Cybersecurity and IT Essentials

August 25, 2022

Cyber Security Expertise - Where Should You Begin?

Whether SEC301 Intro to Cyber Security or SEC401 Security Essentials - Network, Endpoint & Cloud is right for you, depends on your prior knowledge.

Cybersecurity and IT Essentials

February 1, 2021

SANS Historically Black in Cyber: Past, Present and Future

February marks the beginning of Black History Month in the United States. President Ford declared February as “Black History Month” in 1976, but truly the start of this goes back to an idea of a Howard University Professor, Dr. Carter G. Woodson who had the idea for a celebration to acknowledge the...