Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

This does not:```SELECT t.unix_time AS query_time,
       pos.family,
       h.md5,
       h.sha1,
       h.sha256,
       h.directory,
       pos.local_port AS src_connection_port,
       pos.remote_port AS dest_connection_port,
       name,
       p.path AS file_path,
       cmdline,
       pos.protocol
FROM process_open_sockets AS pos
JOIN processes AS p ON p.pid=pos.pid
LEFT JOIN time AS t
LEFT JOIN listening_ports AS lp ON lp.port=pos.local_port AND lp.protocol=pos.protocol
LEFT JOIN hash AS h ON h.path=p.path
WHERE NOT remote_address=''
  AND NOT remote_address='::'
  AND NOT remote_address='0.0.0.0'
  AND NOT remote_address='127.0.0.1'
  AND port IS NULL;```