Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Here is an example. Data from osqueryd.results.log:
```
[
   {
      "name":"process_events",
      "hostIdentifier":"loqpa-VirtualBox",
      "calendarTime":"Wed Jun 19 16:36:12 2019 UTC",
      "unixTime":1560962172,
      "epoch":0,
      "counter":0,
      "columns":{
         "proc.cmdline":"sudo echo Osquery slack",
         "proc.parent":"25159",
         "proc.parent_cmdline":"bash",
         "proc.parent_pid":"/bin/bash",
         "proc.path":"/usr/bin/sudo",
         "proc.pid":"26857"
      },
      "action":"added"
   },
   {
      "name":"process_events",
      "hostIdentifier":"loqpa-VirtualBox",
      "calendarTime":"Wed Jun 19 16:36:12 2019 UTC",
      "unixTime":1560962172,
      "epoch":0,
      "counter":0,
      "columns":{
         "proc.cmdline":"echo Osquery slack",
         "proc.parent":"26857",
         "proc.parent_cmdline":"",
         "proc.parent_pid":"",
         "proc.path":"/bin/echo",
         "proc.pid":"26858"
      },
      "action":"added"
   }
]
```