Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

i believe I have the relevant flags for tls logging &amp; event tables
```
--disable_logging=false
--disable_events=false
--log_result_events=true
--logger_plugin=tls
--logger_tls_period=5
```
the same thing happens with `usb_devices`
```
I0827 16:45:35.411226 18731 scheduler.cpp:100] Executing scheduled query usb_devices: SELECT * from usb_devices;
I0827 16:45:35.439760 18731 killswitch.cpp:60] osquery::Killswitch::IsEnabledError 1 (Cannot call registry item: )
I0827 16:45:35.439841 18731 profiler.cpp:64] rusage field "scheduler.executing_query.usb_devices.success.input.load" is not supported
```