Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Does the platform (Linux/Mac/Win) make a difference in what info osquery can collect about a device? Is one platform less supported than the others?

see <https://osquery.io/schema> for which tables are supported by which platforms

osquery began as a mac solution, and that is still probably the most supported

windows has less support for user-mode security event collection, so there are some key differences there in platform support

Thanks! I saw that page, but missed the platform selector. Excellent.