Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hi all!  What would be the best way to convert multiple unixepoch times in a single query?  For example, in the wifi_networks table, there is an added_at and captive_login_date that both present in the unixepoch format.  Thanks in advance for the help!

Actually, I think I figured it out myself.  Posting for posterity:

SELECT *,
    datetime(added_at, 'unixepoch') AS added_at,
    datetime(captive_login_date, 'unixepoch') AS captive_login_date
FROM wifi_networks;