until osquery 3, osquery used a JSON library that had all sorts of ridiculous behavior. If you’re using osquery 2 an empty array shows up as an empty string. this is now fixed in osquery 3.