Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

In general, it seems like `osquery` might have trouble finding a specific file in the haystack that is a node's filesystem…

Referring to <https://github.com/osquery/osquery/issues/7306>

And the use case I have in mind is: Show me the path of any file named `foo` - is there a "simple" way of doing that now?

Sorta, but not really.

Generally speaking, you cannot get that information without walking the entire file tree. Or maintaining an search index of all the files.

Osquery does not have an easy way to do that. You could imaging building something that uses `file` and has server support, but it will be intensive.

_But_ osquery can talk to macOS spotlight and windows search. So if those are indexed, you can query them.

Alas, my concern is only with Linux at the moment. Thanks.