Vlad Previn
02/21/2023, 8:39 AMos info
system info
osq version (agent) info
had a quick look at the os_version, system_info and osquery_info and not quite clear how we’d join them (by udid or serial ?) in particular for the osinfo oneLucas Rodriguez
02/21/2023, 10:28 AMSELECT os.*, si.*, oi.* FROM os_version os, system_info si, osquery_info oi;
Vlad Previn
02/21/2023, 11:14 AMLucas Rodriguez
02/21/2023, 11:22 AMIf the join-operator is "CROSS JOIN", "INNER JOIN", "JOIN" or a comma (",") and there is no ON or USING clause, then the result of the join is simply the cartesian product of the left and right-hand datasets. If join-operator does have ON or USING clauses, those are handled according to the following bullet points:
Given that these tables all have one row, then the result is all columns in one row.Vlad Previn
02/22/2023, 3:18 AM