Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

What would be the best way to see successful logons from the previous night. Doing a event view query pulls the event viewer logs in order so the ones I currently pull up even with a limit of 500 are for a few days ago.

All evented tables have an event time, and you can use a `WHERE` clause to filter events by date

Thanks, I  had been trying that. The query I set with a between clause looked like this.

SELECT * FROM windows_events WHERE source IN ('Security') AND eventid IN (4625) LIMIT 500 and datetime between '2020-04-14T23:00:00.000000000Z' and '2020-04-14T23:59:00.000000000Z'

Is that the format of the datetime column? I’m just used to *nix where it’s in unix epoch. In any case, you probably have to convert those timestamps to a format sqlite works with before performing comparisons like that

See <https://www.sqlite.org/lang_datefunc.html>