Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

{
        "options": {
                "config_plugin": "filesystem",
                "osquery_log_dir": "C:\ProgramData\osquery\log",
                "logger_plugin": "filesystem"
                "log_result_events": "true",
                "schedule_splay_percent": "10",
                "host_identifier": "hostname",
                "pidfile": "C:\ProgramData\osquery\osquery.pid",
                "db_path": "C:\ProgramData\osquery\osquery.db",
                "debug": "true",
                "verbose_debug": "true",
                "utc": "true"
        },
        "schedule": {
                "system_info": {
                        "query": "SELECT hostname, cpu_brand, physical_memory FROM system_info;",
                        "interval": 600
                }
        },

        "decorators": {
                "load": [
                        "SELECT uuid AS host_uuid FROM system_info;",
                        "SELECT user AS username FROM logged_in_users ORDER BY time DESC LIMIT 1;"
                ]
        },
        "packs": {
             "it-compliance": "C:\ProgramData\osquery\packs\it-compliance.conf",
             "tlcs-monitor": "C:\ProgramData\osquery\packs\tlcs-monitor.conf",
             "tlcs-windows": "C:\ProgramData\osquery\packs\tlcs-windows.conf"

 }
}