Yeah, like the one FB open-sourced (and uses internally still, I believe): https://osquery.io/
I think this is a super good tool, except for all the privacy implications.
I think this is a super good tool, except for all the privacy implications.
We've always treaded carefully around privacy concerns as a project. This is why you don't see tables that access information such as browser history. If you join our Slack channels you will see open discussion of privacy implications for changes and improvements.
There's a balance to be struck between visibility and privacy. If a security team has no visibility into a system, they can't secure that system. This doesn't mean they need to be able to look at your family photos and read your messages.
I work with folks who care deeply about privacy and trust with their users. These folks ensure that osquery configurations are available to users, so that they can see what exactly is being monitored.
If you are curious what osquery can do, I encourage you to check out https://osquery.io/schema/4.3.0/.
The solution will be legal I think in the end, like in some european countries that don't let you do this kind of surveillance on your employees. And if you want to look at an employee's work emails, you do it in front of them with their lawyer present.
I'm glad you guys are trying to keep some semblance of privacy although.