Production-ready detection and response queries for osquery
Summary
Production-ready detection and response queries for osquery provides an osquery-defense-kit with 250+ production-ready queries for detection and incident response. It maps queries to MITRE ATT&CK, targets Linux/macOS, and includes guidance for local detection, production packs, and data collection for IR, plus case studies illustrating detections.