DFIR: From alert to root cause using Osquery without leaving Elastic Security

Q: How do I perform forensic investigations at scale without disk imaging? A: Elastic Security combines Osquery and Elastic Defend to enable distributed, query-driven forensics across your entire fleet. Osquery exposes OS artifacts as SQL-queryable tables, so investigators can retrieve execution history, file activity, and registry entries from thousands of endpoints in real time without collecting full disk images. Q: How do I reconstruct an attack timeline using Osquery? A: Elastic Security's Osquery integration gives you access to execution artifacts like Prefetch, Shimcache, UserAssist, and Shellbags as queryable tables.

By chaining queries across these sources you can reconstruct the full sequence of user and attacker actions, including file downloads, folder navigation, and binary execution, without a forensic workstation. Q: How does Osquery integrate with Elastic Security for incident response? A: Elastic Security includes Osquery Manager natively, with curated forensic queries and packs mapped to ECS. Results are indexed automatically, making them searchable alongside alert data and usable as detection rule inputs. Osquery can also be run directly from alerts, investigation guides, and detection rule response actions.

Q: Can I detect threats with Osquery in addition to investigating them? A: Yes. Scheduled Osquery packs continuously collect endpoint data that Elastic Security indexes under logs-osquery_manager. result*, which can be used as a detection data source for SIEM rules. Queries developed during forensic investigations can be operationalized into scheduled packs, creating a feedback loop between reactive investigation and proactive detection.