Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

so I went to audit if a particular EndpointSecurityFramework/SysExt agent/process (rhymes with CloudPsych) was running *with full disk access* and found almost nothing actually enabled according to the access table in /Library/Application\ Support/com.apple.TCC/TCC.db (either their auto-update or recent macOS updates have done a bangup job of screwing the pooch)

Also excuse me if I happen to be particularly annoyed that 1. it's been broken for over a month coinciding with their last auto-update (at least according to the modification on the row in the db) for said agent and 2. …for some reason I'M THE ONE who gets a ticket when it's the vendor who could have been proactive about this, and not have people trawling reddit for <https://www.reddit.com/r/crowdstrike/comments/u9f2z6/20220422_cool_query_friday_macos_hostinfo_and/|'cool query friday'>