pure-bash-bible VS OSQuery

I believe it's been posted here before, but I also use this for reference whenever I forget the syntax to something, or know there must be a better way than what I am doing.

https://github.com/dylanaraps/pure-bash-bible

I'd say check out the work of William Shotts at https://linuxcommand.org/ His book, "The Linux Command Line" is free for downloading, and there are lots of references to style guides, good practices, and bash templates in the book.

There is also a shorter, HTML version at the same site: https://linuxcommand.org/lc3_learning_the_shell.php

I'm trying to get a little proficiency in all this, and just yesterday I went through the "Further Reading" sections at the end of each chapter, and captured all the likely URLs for further investigation.

One that looks really good is Dylan Araps' "Pure Bash Bible" ( See https://github.com/dylanaraps/pure-bash-bible ) Confession: I found a PDF copy at Libgen, but don't tell anyone. This and the Shotts book have also been thoroughly discussed on Hacker News in the past. (I.e., search on the two titles and you'll probably get all the opinions that you can stand, plus maybe some more hints.)

Bash is profoundly weird, but if/when you can make it work, it's slick.

pure bash bible

I recommend taking a look at https://github.com/dylanaraps/pure-bash-bible

Additionally, Pure Bash Bible is a bit more advanced but really fun to go through it.

Here is another resource I have found useful.

Pure Bash Bible : A collection of pure bash alternatives to external processes.

Perhaps the OP means OsQuery: https://github.com/osquery/osquery

OsQuery is an SQLite extension consisting of hundreds of virtual tables

There's at least one open data quality issue for `process_open_sockets` on macOS[1]. It's a few years old however and, if you aren't seeing that casting error, you probably aren't hitting it. But that's a good example of the kind of debt that's been built up over time.

(In terms of general purpose/flexible tooling, I'm not aware of a close replacement for osquery.)

[1]: https://github.com/osquery/osquery/issues/6319

The largest we have successfully deployed is on the OSQuery schema https://osquery.io/ which is 277 tables and lots of business context (malwares, vulnerabilities, Windows registry keys, etc).

From a self hosted standpoint OSQuery or Wazuh are your best bets for monitoring USB devices. Windows makes blocking really challenging and I’m not aware of any “free” solutions that attempt it.

Configure auditd to monitor host activity: https://izyknows.medium.com/linux-auditd-for-threat-detection-d06c8b941505 or osquery: https://osquery.io/ (or similar software: filebeat for example).

OS Query : Easily ask questions about your Linux, Windows, and macOS infrastructure

Osquery + Fleet. https://osquery.io/ https://fleetdm.com/, using the two allows you to build a query to answer what ever questions you (or an auditor) might have about your environment.