Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

I have just tried the following query (works for mac only):
`SELECT MAX(asl.time) boot_time FROM asl WHERE asl.sender = 'bootlog';`
This will select the latest boot time from the Apple System Log data structure.
Any thoughts on this query? will it always work?

Another query that gives the same result, but uses `last` instead of `asl` is:
`SELECT MAX(last.time) boot_time FROM last WHERE last.type = 2`.
Hopefully `last` won't be deprecated anytime soon.
<@U0JFM04MS> does this sound reasonable?