Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hi Guys, I had a question. If a table is empty and not populated, does using SELECT * from TABLE; give an empty table or no output at all?

all tables' contents are generated in response to the query, so the table doesn't exist anywhere in memory or anything, it doesn't exist until you query

unless it's an evented table, in which case the events are being spooled all the time, and then querying the evented table does empty some or all of the spool depending on your settings

Okay thank you! I am currently trying to enable yara_events for windows, and since the table is not being populated (still testing), it will give an empty output correct?

yes, you might want/need to create a test file that is expected to trigger a yara rule, to make sure it's working

perfect, thank you :slightly_smiling_face: