Tools · Workbench
Endpoint visibility
Lessons on osquery, Velociraptor, and Wazuh: asking hosts questions in SQL or VQL, hunting across a fleet, and alerting on file and configuration changes.
- 5 lessons
- 58 min of reading
- 3 topics
An alert names a host; the investigation needs facts from it: processes, listeners, scheduled tasks, recent file changes. These lessons start with one lab machine and grow to fleet-wide scheduled queries and hunts.
Install agents only on machines you administer. Endpoint telemetry includes user activity, so agree retention and access with whoever owns those machines.
osquery
2 lessons
- 01osqueryi: ask a host questions in SQLUse osqueryi on a lab Linux or Windows host to answer triage questions in SQL: which processes listen on the network, which binaries are deleted from disk, and what starts at boot.11 min
- 02osqueryd schedules: turn a question into fleet telemetryConfigure osqueryd with scheduled queries, read its differential result logs, and ship only additions and removals so a fleet-wide view of new listeners or startup items stays small.11 min
Velociraptor
2 lessons
- 01Velociraptor: stand up a lab server and collect from one endpointRun Velociraptor’s self-contained lab mode, enrol a test client, and collect process, network, and prefetch artifacts from it, keeping the collection results as evidence.12 min
- 02Velociraptor hunts: one VQL question across every lab endpointWrite a VQL query in a notebook, wrap it as a custom artifact, and run it as a hunt across lab endpoints to find every host with a suspicious scheduled task or run key.12 min
Wazuh
1 lesson