Ansible virtualizes

apt

and

dnf

into

packages

- so you can say "check if X package is installed" VS "check if X deb is installed or X rpm is installed" Does OSQuery have any concept of this? I would think something like a "virtual table"?

Not currently. It has

rpm_packages

and

deb_packages

. Having one table that handles both would be very nice however.

You can combine them in a sql query..

Yeah, it's just pretty messy.