Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

It looks good to me. What's a quick way to generate some Windows events?

also if you have a stack exchange account you can make this person's day <https://stackoverflow.com/questions/64481969/why-osquery-does-not-include-computer-event-information-when-reading-windows-e>

&gt;  quick way to generate some Windows events?
Nevermind, got it. My problem was that you have to explicitly enable the event subscriber and publisher with osquery flags: `osqueryi.exe --disable_events=false --windows_event_channels="System,Application,Setup,Security" --enable_windows_events_publisher=true --enable_windows_events_subscriber=true`

Yea, so I tested with it a bit and it works for me (`windows 10` )

That person is me, and yes, he made my day :smile: I was actually trying to compile something myself but i was getting lost in my noobness

i am happy to test it in several environments when ready

I was watching the office hours video, wondering if we will be lucky enough to get this through in 4.7.0?

Thanks <@U7DT2E8B0>! I committed a fix for the formatting issues. Havent really done much dev outside of Python &amp; Powershell :slightly_smiling_face:

<@U01D0Q68669> would love to see it in 4.7 as well, we will see

I was trying to download the MSI from the pipelines to test, but it didn’t seem available yet. Then I have some env with WEC enabled to test it out if it helps