Hi there, this might be an obvious question, but I was wondering where osquery gets the

uuid

field from on Windows, as part of the

osquery_info

table? https://github.com/osquery/osquery/blob/ba4f8581f579c698b62adc426130ed8f45fe4667/specs/utility/osquery_info.table#L5 Does it come from here? https://github.com/osquery/osquery/blob/ba4f8581f579c698b62adc426130ed8f45fe4667/osquery/core/system.cpp#LL141C28-L141C55

Hey Andrew, That's correct, the

uuid

field is set by the

getHostUUID

function here, which in turn calls

osquery::generateHostUUID

here to obtain the actual UUID data using WMI. btw, this thread should be moved to #windows

Future questions will go in that channel. Thank you!