Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

I am using below config

{
  "options": {
    "disable_events": "false",
    "config_plugin": "filesystem",
    "logger_plugin": "filesystem",
    "logger_path": "/var/log/osquery",
    "pidfile": "/var/osquery/osquery.pidfile"
  },

  "schedule": {
    "cpu_time": {
      "query": "SELECT * FROM cpu_time;",
      "interval": 150
    },
    "dns_resolvers": {
      "query": "SELECT * FROM dns_resolvers;",
      "interval": 150
    },
    "file_events": {
      "query": "select * from file_events;",
      "interval": 150
    }
  },
  "file_paths": {
    "passwd": [
        "/etc/passwd"
    ]
  }
}