Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

image.png

Hello - I'm completely new to SQL and OSquery - I'm confused how I join 3 disparate tables if there's no key to join/pivot off of?  for example these 3
```select hostname from system_info; 
select address from interface_addresses;
select version from kernel_info;  ```
sorry for the newb question

All three tables has a column `hostname` that you can use to join the results on.

ah, I was wondering if there was an implied hostname that I could reference - it's not listed in the schema portal

Yes you’re right. I guess that is because the column `hostname` is not part of the table itself, it is added to every table. But I don’t really know.

But you can always do something like `select * from system_info;` to get a list of all available columns as an overview and then select the ones you want.