--- title: What is CISA's Goose Tool? - 3 Tree Tech description: The tool is designed to help network defenders detect malicious activity in MSFT Azure, AD, and 365 environments. But is it helpful? image: https://insights.3treetech.com/hubfs/Imported_Blog_Media/goose-tool.jpg --- [Skip to content](https://insights.3treetech.com/news/what-is-cisas-goose-tool#main-content) ![3 Tree Tech Logo](https://insights.3treetech.com/hs-fs/hubfs/3%20Tree%20Tech%20Trees.png?width=5454&height=3126&name=3%20Tree%20Tech%20Trees.png) Open main navigation Close main navigation - [Contact us](mailto:info@3treetech.com) [Contact us](mailto:info@3treetech.com) 4/20/23, 12:00 AM # What is CISA's Goose Tool? [Jacob Friedman](https://insights.3treetech.com/news/author/jacob-friedman) Share: [linkedin-in icon](http://www.linkedin.com/shareArticle?mini=true&url=https://insights.3treetech.com/news/what-is-cisas-goose-tool) [Share this page on X](https://twitter.com/intent/tweet?url=https://insights.3treetech.com/news/what-is-cisas-goose-tool) [Share this page on Facebook](http://www.facebook.com/share.php?u=https://insights.3treetech.com/news/what-is-cisas-goose-tool) [envelope icon](mailto:?body=https://insights.3treetech.com/news/what-is-cisas-goose-tool) A free tool has been released by the Cybersecurity & Infrastructure Security Agency (CISA) called “Untitled Goose Tool” or Goose for short. CISA states that the free tool helps network defenders detect potentially malicious activity by assisting in data gathering and authentication.  At one of our recent 3 Tree Tech security events, a respected CISO asked me to look into this tool and determine if it’s worth using. ## **What is Goose?** As stated on CISA.gov, this tool is free. It’s designed to “help network defenders detect potentially malicious activity in MSFT Azure, AD, and 365 environments.” It accomplishes this through gathering and authenticating data. In theory, it sounds helpful, and it’s hard to beat the price of free. To determine if it is worth its salt however, I connected with a couple tenured CISO’s in my network and asked for their insight. One of the CISO’s I connected with warned against placing too much trust in the tool. Although this tool can be appealing to organizations with tight security budgets, it can potentially lead to wasting time and money. This is because the items/vulnerabilities you target to fix may lack context. Without context, you may end up treating a symptom of an issue rather than the root cause. Just like any other tool, there will always be limitations. However, let’s discuss where this tool can shine. ## **Benefits of CISA’s Goose Tool ** The Untitled Goose Tool could be of great use to an organization that may not have a SIEM in place and wishes to log events from a MS Azure environment. A respected Infosec source who preferred to be unnamed for this article informed me of three potential fits for the tool:  - An internal incident responder in a less mature organization that does not have the budget for a full SIEM to manage events would be able to quickly pull data for analysis and use it to triage or identify an event. - An external incident responder who may not trust the SIEM of the client (concerns of a compromised SIEM) can use this to acquire unfiltered data. - During the due diligence phase of acquiring a company, the tool can be used to access and review data about an acquisition target’s posture and potential security issues without having to gain full access to the target’s SIEM. These three uses are valuable, but if an organization already has a robust SIEM solution in place, and has their Azure environment reporting event data to it, then there is limited value. (Unless SIEM compromise is a concern). ## **General security concerns:** Due to the various tales of vendors and agencies being breached recently, there has been an erosion of trust and increase in paranoia within the security community.  Although it may seem like common sense, any company implementing code from external sources should still do an appsec review in accordance to their own levels of risk tolerance. The lower the tolerance, the more they should scrutinize the code. CISA or any other government entity shouldn’t be trusted any more or less than the code you can obtain from various internet sources. (Ex = StackExchange). At the end of the day they are an unknown 3rd party.  However, it could be argued that tools such as Goose allow for a higher confidence level since you can actually inspect the code as opposed to pre-compiled binaries you may receive from a for-profit vendor. ## **Conclusion** Overall, this tool could be a great resource to organizations in select situations. It is important to not rely too heavily on a tool, which can be said about anything on the market. You have to make sure your doors and windows are locked before you start worrying about someone tunneling in from the backyard. If anything, the release of this tool is a reflection of our country’s commitment to taking cyber seriously, and we will hopefully see more collaboration between the federal and private sectors in the future. ![Jacob Friedman of 3 Tree Tech](https://insights.3treetech.com/hs-fs/hubfs/Imported_Blog_Media/jacob-friedman-2-Jul-06-2024-10-20-57-6441-AM.jpeg?width=900&height=900&name=jacob-friedman-2-Jul-06-2024-10-20-57-6441-AM.jpeg) *[**Jacob Friedman**](https://www.3treetech.com/team/jacob-friedman/) is a Strategic Account Director at 3 Tree Tech in Portland. He enjoys researching new disruptive tech across the full stack and introducing it to tech execs across the United States. Message him [**right here.**](https://www.3treetech.com/contact-us/)* - [LinkedIn](https://www.linkedin.com/in/jfriedmantech/) *FYI: The goose anchor image was created with AI. Because computers…* [Security](https://insights.3treetech.com/news/tag/security), [News](https://insights.3treetech.com/news/tag/news) ## Related posts [![](https://insights.3treetech.com/hs-fs/hubfs/Imported_Blog_Media/password-management.jpg?height=200&name=password-management.jpg)](https://insights.3treetech.com/news/secrets-management-vs-password-vaulting) [CX](https://insights.3treetech.com/news/tag/cx), [Security](https://insights.3treetech.com/news/tag/security) ## [Secrets management vs password vaulting? What's the difference?](https://insights.3treetech.com/news/secrets-management-vs-password-vaulting) [Jacob Friedman](https://insights.3treetech.com/news/author/jacob-friedman) 8/1/23, 12:00 AM When a client asked about the difference between secrets management and password vaulting, I... [Read more](https://insights.3treetech.com/news/secrets-management-vs-password-vaulting) [News](https://insights.3treetech.com/news/tag/news) ## [Are VARs worth it anymore?](https://insights.3treetech.com/news/are-vars-worth-it) [Jacob Friedman](https://insights.3treetech.com/news/author/jacob-friedman) 9/5/22, 12:00 AM Technology leaders, CISOs have changed how they make purchasing decisions. Value Added Resellers... [Read more](https://insights.3treetech.com/news/are-vars-worth-it) [![](https://insights.3treetech.com/hs-fs/hubfs/Imported_Blog_Media/MS-Teams.jpg?height=200&name=MS-Teams.jpg)](https://insights.3treetech.com/news/why-are-teams-invites-added-to-zoom-meetings) [Security](https://insights.3treetech.com/news/tag/security), [News](https://insights.3treetech.com/news/tag/news) ## [Why are Teams invites added to Zoom meetings?](https://insights.3treetech.com/news/why-are-teams-invites-added-to-zoom-meetings) [Jacob Friedman](https://insights.3treetech.com/news/author/jacob-friedman) 6/29/22, 12:00 AM Why are Teams invites added to Zoom meetings? What, you thought it was just you? It’s actually... [Read more](https://insights.3treetech.com/news/why-are-teams-invites-added-to-zoom-meetings) [linkedin-in icon](https://www.linkedin.com/company/3treetech/) [X Twitter icon](https://x.com/3treetech) [instagram icon](https://www.instagram.com/3treetech/) [Follow us on Facebook](https://www.youtube.com/channel/UC87LNRlC0dHVoBOyE32mEYQ) --- [![3 Tree Tech Logo](https://insights.3treetech.com/hs-fs/hubfs/3%20Tree%20Tech%20Trees.png?width=5454&height=3126&name=3%20Tree%20Tech%20Trees.png "3 Tree Tech Logo")](https://www.3treetech.com) 1916 NW 24th Ave, Portland, OR 97210 Copyright © 2024 | 3 Tree Tech ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Jacob Friedman", "url" : "https://insights.3treetech.com/news/author/jacob-friedman" }, "dateModified" : "2024-07-06T10:22:25.279Z", "datePublished" : "2023-04-20T07:00:00.000Z", "headline" : "What is CISA's Goose Tool? - 3 Tree Tech", "image" : [ "https://insights.3treetech.com/hubfs/Imported_Blog_Media/goose-tool.jpg" ], "mainEntityOfPage" : { "@id" : "https://insights.3treetech.com/news/what-is-cisas-goose-tool", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://insights.3treetech.com/hubfs/3%20Tree%20Tech%20Trees.png" } } } ```