Lion Cipher Lab
Configure osquery and query your own machine like a database
- Digital Forensics & IR (DFIR)
- Beginner
- ~30 min
- Free · no account required
Why it matters
Defenders live or die on visibility: you cannot investigate, hunt, or respond on a machine you cannot see into. The live-triage sweep answers the core questions with native commands, but each command has its own output format, its own options, and does not travel well across a hundred machines. osquery reframes the same problem in one consistent way — it exposes the operating system's live state as relational tables and lets you ask questions with SQL. "What is running" becomes SELECT FROM processes; "what is listening" becomes SELECT FROM listening_ports; "who is on this box" becomes SELECT…
What you'll learn
- endpoint visibility
- osquery
- querying the OS as SQL tables
- running osqueryi
- reading the processes table
- reading listening_ports
- reading logged_in_users
- reading startup_items
- how an endpoint agent scales to a fleet
- threat hunting basics
Steps in this lab
- The idea: your operating system as a database
- Install osquery on your machine
- Open osqueryi and look around
- What is running? Query the processes table
- What is it talking to? Query listening_ports
- Who is on this machine? Query logged_in_users
- What starts by itself? Query startup_items
- From one machine to a fleet: osqueryd and threat hunting