#Query osquery on another machine install#

osquery provides somewhat flexible node (the machine running osquery) authentication and identification though an 'enrollment' concept. They very simply, receive and report via URI endpoints. The only built-in optional plugins are tls. osquery's remote configuration and logger plugins are completely optional. You will have to dig deeply both into osquery, alpine, and docker. /en/1.8.2/deployment/remote/ Remote Settings. So sure, you can make osquery work, but it won't be easy.

Every instance of Kolide Cloud ships with an osqueryschedule collection enabled, which continuously aggregates data about query execution and performance. If osquery works on an least two different distro families (deb- and rpm based ones), then yes, it should work also on Alpine. Osquery includes a table called osqueryschedule, which keeps a record of all queries run on a machine, along with the performance characteristics of these queries. Its main reason is the security - not being really security-hardened, they need to disable a lot of important linux kernel features (for example, they've simply disabled the unix datagram sockets, this is why syslogd doesn't work very well in docker containers).

Yes, this is what docker offers, but it doesn't fulfill it. It is not a common practice that you download a docker container, write a 10 line long script on it and it will work like charm.

#Query osquery on another machine install#

The targeted goal of Docker is to be able to quickly install and deploy containers for anything, on anything.įor this reason, it is a common practice to put anything into docker containers, including security tools, but it is not hardened against breaking out from a container into the physical machine (although doing this is harder as it seems). Docker is never targeted security and privilege separation.