Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

<https://www.carbonblack.com/2018/08/02/carbon-black-announces-cb-liveops-a-new-offering-on-the-cb-predictive-security-cloud-psc-delivering-real-time-query-and-response/>

I don't understand -- doesn't this cannibalize CB Respond?

i think that CB inserted osquery because is more easy to get info with sql query from the hosts

but i agree that it can cannibalize CB Respond

the concept of sql queries is way better than what the likes of CB respond and Tanium are doing imho

the schema is well defined and structured

so I would agree with that, but I don't get their product decision. Seems like they are bolting crap on the side and calling it another product offering *shrugs*