hi there! I am noob to osquery. Is there a ER (entity relationship) diagram for osquery schema, much like in traditional RDBMS? That will help understand how the tables are linked together and what info can be queried.
07/05/2020, 3:13 PM
Hey @CK Kee wrote this blog about the relationships, this might help you on your way. Working on the next more accurate version at the moment.
“Untangling the Osquery❓ tables web🕸️ using Jupyter Notebooks📓” by Sevickson https://link.medium.com/3sJ1mLrnS7
07/06/2020, 3:53 AM
hey @SK! This is really cool! Thanks for sharing!
07/06/2020, 6:03 PM
That’s really neat looking. But also a little misleading. osquery tables are (generally) light wrappers around underlying os apis. What a given column name means is table specific. And frustrating, some names are divergent that shouldn’t be, while some are the same that also shouldn’t be.
It makes me think that idea might be a good starting point to review this.
FWIW I generally approach this the other way — for a given piece of OS data, what other data would want to join. And knowing that, is there a table for it?
07/06/2020, 6:04 PM
@seph You have good points that I also stumbled upon as we speak I am working on a more correct approach by looking at the data and not the column name. In my blog I also have some improvements written.