Indeed -- Osquery, and the commercial precursor Tanium and the native Microsoft equivalents, can help when you've identified one incident and want to find active repeats. Ex: "I just cleaned evil.exe from this box, are any other hosts running the same process? What other processes do they have in common?". I've seen hunting use cases as well.
Your example is why we're building our visual playbook system. In this case, query your network scanner for open ports, and then feed the identified hosts into more targeted osquery calls.
Your example is why we're building our visual playbook system. In this case, query your network scanner for open ports, and then feed the identified hosts into more targeted osquery calls.