https://github.com/osquery/osquery logo
#general
Title
# general
s

Steven Adams

07/20/2018, 3:05 AM
I'm new to OSQuery and am wondering if there's any documentation on how the tables relate to each other. In other words, which column in table A make sense to use with which other column in table B to create a join condition? For example, there are a lot of "uid" and "uuid" columns but I'm not sure they necessarily make sense to use together in joins. Some are even different data types (text vs. integer).
v

Vibhor

07/20/2018, 1:48 PM
This would help you! https://osquery.io/schema/3.2.6
s

Steven Adams

07/20/2018, 7:32 PM
I'm familiar with that. I've even made a spreadsheet based on it in an attempt to clarify which ID columns can be matched with which others in joins, but am still uncertain in some cases.
2 Views