Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hi there
There is way to join between *scheduled_tasks to username or user_id ?* 

Hello <@U018CU81VC1> I don't think there is a direct way to join this to a username or user_id, the direct connections I could find were these, maybe it can help you on your way. Each line is a possible join.
```autoexec.name, scheduled_tasks.name
autoexec.name, programs.name, registry.name, scheduled_tasks.name
autoexec.name, registry.name, scheduled_tasks.name
autoexec.name, logon_sessions.logon_type, scheduled_tasks.name
autoexec.name, interface_addresses.friendly_name, interface_details.connection_id, scheduled_tasks.name
autoexec.name, scheduled_tasks.name, startup_items.name
autoexec.name, programs.name, scheduled_tasks.name
autoexec.path, scheduled_tasks.path
background_activities_moderator.last_execution_time, scheduled_tasks.last_run_time```

Do you know if can I get username from the following direct tables

I'm not sure any of these tables will give you what you want, you want to know the author of the scheduled_task right?

But you should be able to JOIN to the `background_activities_moderator` table and that table has SID (UserID) that should give you the user that the task is run under...

Let me know if you get any results from that, curious to know if you get the desired data.

BTW interesting to know you would think that the path in both tables can be used to JOIN but the way it is represented makes it not possible.