I'm new to OSQuery and am wondering if there's any...
# general
s
I'm new to OSQuery and am wondering if there's any documentation on how the tables relate to each other. In other words, which column in table A make sense to use with which other column in table B to create a join condition? For example, there are a lot of "uid" and "uuid" columns but I'm not sure they necessarily make sense to use together in joins. Some are even different data types (text vs. integer).
v
This would help you! https://osquery.io/schema/3.2.6
s
I'm familiar with that. I've even made a spreadsheet based on it in an attempt to clarify which ID columns can be matched with which others in joins, but am still uncertain in some cases.