have you gone through <http://osquery.readthedocs....
# general