https://osquery.readthedocs.io/en/latest/ the documentation is pretty good if you start with "using osqueryi" you can try queries on your own system first