osquery> select name, publisher, type, subscriptions, events, active from osquery_events;
+---------------------+-----------------+------------+---------------+--------+--------+
| name                | publisher       | type       | subscriptions | events | active |
+---------------------+-----------------+------------+---------------+--------+--------+
| diskarbitration     | diskarbitration | publisher  | 1             | 5      | 1      |
| fsevents            | fsevents        | publisher  | 0             | 0      | 1      |
| iokit               | iokit           | publisher  | 1             | 0      | 1      |
| kernel              | kernel          | publisher  | 0             | 0      | 0      |
| scnetwork           | scnetwork       | publisher  | 0             | 0      | 0      |
| disk_events         | diskarbitration | subscriber | 1             | 5      | 1      |
| file_events         | fsevents        | subscriber | 0             | 0      | 1      |
| hardware_events     | iokit           | subscriber | 1             | 0      | 1      |
| process_events      | kernel          | subscriber | 0             | 0      | 0      |
| process_file_events | kernel          | subscriber | 0             | 0      | 0      |
| yara_events         | fsevents        | subscriber | 0             | 0      | 1      |
+---------------------+-----------------+------------+---------------+--------+--------+
osquery> select name, publisher, type, subscriptions, events, active from osquery_events;
+---------------------+-----------------+------------+---------------+--------+--------+
| name                | publisher       | type       | subscriptions | events | active |
+---------------------+-----------------+------------+---------------+--------+--------+
| diskarbitration     | diskarbitration | publisher  | 1             | 5      | 1      |
| fsevents            | fsevents        | publisher  | 0             | 0      | 1      |
| iokit               | iokit           | publisher  | 1             | 3      | 1      |
| kernel              | kernel          | publisher  | 0             | 0      | 0      |
| scnetwork           | scnetwork       | publisher  | 0             | 0      | 0      |
| disk_events         | diskarbitration | subscriber | 1             | 5      | 1      |
| file_events         | fsevents        | subscriber | 0             | 0      | 1      |
| hardware_events     | iokit           | subscriber | 1             | 3      | 1      |
| process_events      | kernel          | subscriber | 0             | 0      | 0      |
| process_file_events | kernel          | subscriber | 0             | 0      | 0      |
| yara_events         | fsevents        | subscriber | 0             | 0      | 1      |
+---------------------+-----------------+------------+---------------+--------+--------+
osquery> select * from hardware_events where path <> '' or model <> '';
osquery> select * from hardware_events;