Osquery: Expose the operating system as a relational database
This is really interesting and very cool to see. The approach we're taking with Eve (gory details at [1]) is that you can treat everything as relational and doing so provides lots of benefits. One thing that wasn't clear though, was how you extend that notion down into the OS-level for both performance and semantic reasons. It's encouraging to see someone with requirements as deep as facebook's find that this strategy works in that context.<p>The next step would be <i>manipulating</i> the OS as relations. E.g. an insert into the process table allows you to actually spawn a process. It would start to get really interesting from there...<p>[1]: <a href="http://incidentalcomplexity.com/2014/10/16/retrospective/" rel="nofollow">http://incidentalcomplexity.com/2014/10/16/retrospective/</a>