JOINing Across the Stack: Structured Security Analytics for the modern attack surface

The talk starts from the problem that an organization's attack surface now spans laptops, servers, containers, cloud accounts, SaaS applications and identity providers. Each cloud provider exposes its own APIs and data formats, so visibility ends up split across many silos and defenders struggle to ask consistent questions.

The speaker presents structured security analytics as a set of open-source tools that turn this data into SQL tables. osquery covers hosts, endpoints and virtual machines, with scheduled and real-time queries and results that can be shipped to a file, a socket or a streaming pipeline. cloudquery extends the same approach to AWS, GCP and Azure resources, and kubequery covers Kubernetes clusters as a daemon set. A minimal upstream endpoint, query tls, can collect the results. The middle of the talk walks through a hypothetical intrusion in which stolen IAM credentials launch an instance, a script reads sensitive data from an S3 bucket and a curl command sends it out. Cloud API tables are paired with host process, socket, DNS and file tables, and the results can be checked against domain, IP and TLS fingerprint reputation data to follow each stage. Other examples include checking S3 encryption and versioning settings against CIS benchmark guidance and testing IAM password policy requirements, with a short live demo of the password policy check.

The main takeaway is that a team already fluent in SQL can apply the same query skills across endpoints and cloud platforms, and that scheduled queries build a history useful for drift monitoring and compliance. The speaker notes that the cloud tables are still being expanded and that some returned fields remain raw JSON, so coverage is partial.