Just wanted to give a shoutout to @Garret, I played around with the WIP

unified_log

table (https://github.com/osquery/osquery/pull/6904) this morning and yesterday, alongside some helpful reading from Sarah Edwards @ https://mac4n6.com, and I am super excited! Lots of cool stuff that can be pulled out of there that will be helpful for many teams I am sure! A small teaser PoC of what can be done:

+---------------------+--------------+------------+
| login_timestamp     | login_method | username   |
+---------------------+--------------+------------+
| 2021-05-12 10:52:06 | password     | fritz-imac |
| 2021-05-12 10:26:21 | watch        | fritz-imac |
| 2021-05-12 09:52:53 | password     | fritz-imac |
| 2021-05-12 08:58:13 | password     | fritz-imac |
| 2021-05-11 20:59:29 | watch        | fritz-imac |
| 2021-05-11 16:34:57 | password     | fritz-imac |
| 2021-05-11 16:02:06 | password     | fritz-imac |
| 2021-05-11 16:00:09 | watch        | fritz-imac |
| 2021-05-11 15:26:18 | watch        | fritz-imac |
| 2021-05-11 11:36:44 | password     | fritz-imac |
| 2021-05-11 11:10:56 | watch        | fritz-imac |
| 2021-05-11 10:58:42 | password     | fritz-imac |
| 2021-05-11 10:51:40 | password     | fritz-imac |
| 2021-05-11 10:36:16 | password     | fritz-imac |
| 2021-05-11 09:11:51 | watch        | fritz-imac |
| 2021-05-10 12:59:18 | watch        | fritz-imac |
| 2021-05-10 12:30:21 | watch        | fritz-imac |
| 2021-05-10 09:27:12 | watch        | fritz-imac |
| 2021-05-10 08:23:55 | watch        | fritz-imac |
| 2021-05-09 20:01:14 | watch        | fritz-imac |
+---------------------+--------------+------------+