hello; is there a way of doing regular expression matching when doing a query? (LIKE "%foo%" matching is too greedy for me 🙂)

Hi @Tor Houghton! osquery supports regex_match, the syntax for that would be something like this:

SELECT * from <table> WHERE regex_match(<column>, <expression>, 0) IS NOT null;

Ah! Thank you, I'll give this a go!