Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Anybody know if it's is possible to add an existing sqlite db ? /private/var/db/CoreDuet/Knowledge/knowledgeC.db has really interesting forensics data and I would love to query it from osquery

see <https://www.mac4n6.com/blog/2018/8/5/knowledge-is-power-using-the-knowledgecdb-database-on-macos-and-ios-to-determine-precise-user-and-application-usage>

self note : <https://github.com/facebook/osquery/pull/4271>