|
所在平台: Udemy |
课程主页: https://www.udemy.com/course/cyber-security-osquery/
课程评论：没有评论
课程名称：网络安全：掌握osquery 课程概述：osquery是一个操作系统仪表框架，用于从操作系统、虚拟机及应用程序收集信息。它常用于安全取证、应用性能管理和合规性审计。osquery支持多种平台，包括Windows、Linux和macOS。该工具集提供了一种基于SQL的界面，用于查询操作系统数据，允许在一个既强大又安全的环境中构建复杂查询，用户可以通过与AND/OR操作符组合单个或聚合组件，灵活地定义查询工作流。osquery的目标是提高操作系统的透明度，通过收集操作系统信息并将其提供给客户端（osquery客户端，作为osqueryd的一部分），用户可以使用类似SQL的查询语言进行查询。 虽然许多命令行工具（如ps、lsof、netstat或ss）在每个Linux发行版上都可用，但这些工具通常需要特定权限（通常是root），且应用范围较窄。而使用osquery命令行工具不涉及权限提升。 在本课程中，您将学习如何使用osquery查找计算机和服务器的信息。此课程适合初学者，无需任何先前知识，甚至不需要了解SQL。如果您是系统管理员、开发者或安全研究员，这门课程非常适合您。
osquery is an operating system instrumentation framework for collecting information from operating systems, hypervisors and applications. It is often used to collect information for security forensics, application performance management and compliance auditing. osquery supports multiple platforms including Windows, Linux and macOS.The osquery toolset provides a SQL-based interface for querying operating system data. This allows complex queries to be constructed within a familiar environment that is both robust and secure. A query may consist of individual or aggregated components that are composed together with AND / OR operators to form a complete query. This provides the flexibility that is unique to SQL-based interfaces and allows users to define a flexible query workflow.It is a project that aims to make operating systems more transparent. It does this by collecting information from the operating system and making it available to clients (the osquery client, shipped as part of osqueryd), which can then be queried using a SQL-like query language.A lot of command-line tools such as ps, lsof, netstat or ss are available on every Linux distribution and allow you to query the operating system. However, these tools often require particular privilege to run (typically root) and have a narrow scope. No privilege escalation is involved in using the OSQuery command line tool.In this course you will learn how to use OSQuery to find information about your computers and servers. It is a beginners course and no prior knowledge is required, not even about SQL. If you are a sysadmin, developer, security researcher then this course is for you.
