Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

what does the `'c` kindof-suffix represent?

mdfind syntax:
``` &amp;&amp; = AND
 || = OR
 * = Wildcard symbol
 'string'c = Case insensitive (eg. 'StRiNg' == 'string'c)
 'string'd = Diacritical Mark Insensitive (eg. 'śtrîñg' == 'string'd)```

you can also stack case and diacritical insensitivity

though the diacritical marks are usually less of an issue unless dealing with a substantially international install-base

and I was thinking NSPredicate was hard to interact with, it makes sense mdfind would have this stuff but I swear I've never seen a reference cover it before

<https://www.kolide.com/blog/how-to-spotlight-search-across-every-mac-with-osquery#mdfind-query-syntax-tips>

This is largely sourced from the Apple documentation found here:
<https://developer.apple.com/library/archive/documentation/Carbon/Conceptual/SpotlightQuery/Concepts/QueryFormat.html>