Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

I am trying to extend osquery by searching for windows event viewer event IDs ... is that possible?

Yes however this is an “evented table” <https://osquery.io/schema/5.0.1/#windows_events>

```SELECT data FROM windows_eventlog WHERE channel = "Security" and eventid = "4672";```
Will show results for example where
```SELECT data FROM windows_eventlog```
Will not it will need to be appropriately constrained.

<https://github.com/osquery/osquery/blob/master/specs/windows/windows_events.table>