Stephen Touset
09/28/2017, 7:18 PMosquery> SELECT username, key FROM users JOIN authorized_keys USING (uid) WHERE authorized_keys.key LIKE 'ssh-rsa %' LIMIT 1;
... virtual_table.cpp:516] The authorized_keys table returns data based on the current user by default, consider JOINing against the users table
... virtual_table.cpp:531] Please see the table documentation: <https://osquery.io/docs/#authorized_keys>
theopolis
10/06/2017, 1:01 AMosqueryi
with osqueryi --planner
and run the query again?