Hi all, I'm trying to set up my own sqlite database with the complete osquery (5.9.1) schema, for running some experiments. To do this I need the

create

statements of the entire schema for all OS's (277 tables according to https://www.osquery.io/schema/5.9.1 ).

.schema

is what I need, but it returns only 182 tables on my macbook. I also tried

.tables

and

SELECT * FROM osquery_registry

Any suggestions on how to get all 277 tables?

Hi @Stijn Tilborghs, that's because not all tables are present on all platforms. You can parse the JSON used by the website to generate that page, which has the information for each table: https://github.com/osquery/osquery-site/blob/source/src/data/osquery_schema_versions/5.10.2.json

I was afraid this might be the case 😅 Thanks Stefano.

There are also the spec files that osquery uses to generate the C++ for the tables: https://github.com/osquery/osquery/blob/master/specs/arp_cache.table

The json looks good, probably not that much work. Alternatively I may just spin up a windows + linux VM and run osquery there.