Osquery Monthly: June 2019

What's happening in the world of osquery?

Welcome to the inaugural Osquery Monthly! We’re looking to provide a roundup of information about what is going on in the osquery community. If you have ideas for items to be covered, please get in touch.

In this month’s edition we discuss the upcoming QueryCon, what is happening with the osquery community fork, and the future of osquery stewardship.

QueryCon: The osquery conference

The second annual QueryCon will take place next week, June 20-21 in NYC. Tickets are still available, so grab them now to learn and connect with the osquery community.

Among the many talks on the program are:

  • Monitoring Ephemeral Infrastructure with osquery - Matt Jane (Segment) presents strategies for using osquery in containerized and ephemeral environments.
  • All you can do with extensions - Victor Vrantchan (Google) sees a future in which osquery can be infinitely flexible through custom extensions. He uses his experience to invite others to bend osquery to their will.
  • Taking Osquery to the Mainstream to Benefit Us All - Tania McCormack (Carbon Black) discusses what we can do to increase momentum for the osquery project.

There are a number of additional talks, an interactive workshop, and an after-hours social event. Hope to see you there!

osql: A community fork

Community development of osquery is back on track with the new osql fork. The stated goals of this fork are to return multi-platform CMake build support, continue momentum of community contributions, and establish a regular release cycle.

So far we’ve seen Trail of Bits actively engaging with the community through biweekly office hours (next on Tuesday 6/25/19 at 10AM PST), rebuilding a public CI, and merging pull requests.

For more, join the #osql channel on osquery Slack.

Future of osquery stewardship

Facebook has indicated that they are moving towards a new model for community stewardship of the osquery project. This is a welcome change after more than a year of Facebook’s relative silence.

Public details are not yet available, but a discussion of the future is planned to take place during QueryCon. Expect to see an update on this in the next edition of Osquery Monthly.

Here’s hoping that the community can rally behind a new, independent, osquery!

Tidbits