osquery Defense Kit: 250+ Production-Ready Detection Queries

Production-ready detection and response queries for osquery

Chainguard's open-source osquery-defense-kit (ODK) provides over 250 detection and incident response queries designed for production use. Unlike typical osquery packs, these queries are tuned to return zero rows during normal behavior, enabling seamless alerting. The kit covers MITRE ATT&CK tactics for Linux and macOS, with case studies showing how it detects malware like Shikitega and CloudMensis. It includes tools for local detection, data collection, and pack generation, with a focus on minimizing false positives and CPU overhead.