@fritz Thanks for this good article - https://blog.kolide.com/running-osquery-as-sudo-root-vs-user-4fcfc698c45e. Esp this part _"Important Note: You may be wondering why we use a CROSS JOIN instead of a simple JOIN. In SQLite CROSS JOIN allows us to explicitly specify the order the SQLite engine queries each table. In the example above, SQLite will first enumerate all the users, and then attempt to join them with chrome_extensions. With a normal JOIN the SQLite query planner may incorrectly choose to run SELECT * FROM chrome_extensions; before enumerating all of the users. This won’t work and will result in osquery erroneously returning no data."_ I have run into this issue before but never knew the root cause. Just that a

CROSS JOIN

"just worked".