Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Here is shortened version of it:
```
SELECT proc.pid, proc.path, proc.cmdline, proc.parent, (CASE WHEN prnt.pid THEN prnt.path ELSE prnt_static.path END) AS 'proc.parent_pid', (CASE WHEN prnt.pid THEN prnt.cmdline ELSE prnt_static.cmdline END) AS 'proc.parent_cmdline' FROM process_events AS proc LEFT JOIN (SELECT * FROM process_events) AS prnt ON proc.parent=prnt.pid LEFT JOIN (SELECT * FROM processes) AS prnt_static ON proc.parent=prnt_static.pid;
```