Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

image.png

i want it to look like the software tab but there isn't a way to sort by windows or export in the software tab

<@U05RU9SSZ7H> What does your current query look like?

SELECT
    name,
    version,
    COUNT(*) AS install_count
FROM
    programs
WHERE
    name IS NOT NULL
GROUP BY
    name, version
ORDER BY
    install_count DESC;

It sounds like the<https://fleetdm.com/docs/rest-api/rest-api#list-software| list software> endpoint should do the trick nicely for this usecase!

You can filter that by `platform` to get only Windows software and order descending by host count.

Live queries won't work for this since they run on each host in isolation and only have that host's data available to query, so you can't get aggregate results across all hosts.