Defensive / Blue

osquery

SQL-powered endpoint visibility agent.

intermediate

Linux

Windows

macOS

Defense

Forensics

Authorized testing only. Practice on systems you own, isolated labs, or targets with written permission. Unauthorized access is illegal.

Querying host state for IR or baseline hardening verification.

osqueryi interactive; write SQL for processes, listening ports, users.

Security engineering mindset for host telemetry.

Commands & usage

osqueryi

SELECT pid,name,path FROM processes;

SELECT * FROM listening_ports;

Commands are educational examples. Adapt hosts, paths, and rates to your authorized scope.

Sigma Rules

Generic detection rule format convertible to SIEM queries.

Suricata

Network IDS/IPS and network security monitoring engine.

Wazuh

Open-source XDR/SIEM platform for log analysis and FIM.

Fail2ban

Bans IPs that show malicious signs (e.g., too many SSH failures).