Nowhere near as cool as tagging, but I put out another in my osquery “basics” series — this was actually written before the mac admin one, but got released slightly out of sequence. This is meant to show people “SQL 101" once they have osquery installed. It’s out now. https://www.uptycs.com/blog/sql-introduction-for-osquery (hopefully no typos this time, but if so, please let me know!)