This week, I spoke with Ahmed Elshaer (DFIR, Blue Team, SecOps) about how Wayfair uses Fleet and osquery:
We were looking for a tool that provided linux logging, and incident response capabilities. Osquery had most of the requirements like logging, ability to scope an incident, interrogate systems but it’s missing the response or the ability to do an action on the remote systems.
We have POC’d couple free options and Fleet was the highest engagement and continuous development although it may be missing some features. How do your end users feel about Fleet?
We are using Fleet only in the remote query on scale, so we find Fleet is doing a good job in that area, and it’s easy to use for any new members.
We have lots of queries that generate logs, but the ones that go into alerts are verified queries that are intended to hunt malicious or suspicious activity. Those activities are known based on public threat reports, Mitre Attack, or internal Red Team exercise.
Fleet is doing a pretty good job now by listening to users in different channels, and I’ve seen lots of my discussions and ideas come into
Fleet very fast, after a release or two. What I hope to see in Fleet are the following: