@lvferdi, looks to me like it grabs

.ssh/authorized_keys

and

.ssh/authorized_keys2

from the home directory of the user. By default, it grabs the current user that Osqueryd/Osqueryi is running as but you can

JOIN

against the

users

table to change that.