Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

{
      "created_at": "2019-07-19T07:57:19Z",
      "updated_at": "2019-07-19T07:57:19Z",
      "deleted_at": null,
      "deleted": false,
      "id": 401,
      "name": "windows-incorrect_parent_process.conf",
      "description": "ATT\u0026CK: T1173,T1086,T1204,T1183",
      "platform": "windows",
      "disabled": false,
      "query_count": 11,
      "total_hosts_count": 1,
      "host_ids": [],
      "label_ids": [
        10
      ]
    },