(Replying to PARENT post)

Cool, so basically it brings something like WQL to nix, because this is something that exists in Windows already:

    SELECT * FROM Win32_LogicalDisk WHERE FreeSpace < 2097152
👤MrBuddyCasino🕑11y🔼0🗨️0

(Replying to PARENT post)

Hey, Mike Arpaia here. You're totally right in that the SQL interface is very similar to WMI. Some core differences with osquery are:

- it's cross platform and supports many *nix operating systems

- adding new tables is very well supported via a simple API: https://github.com/facebook/osquery/wiki/creating-a-new-tabl...

- several tools and utilities exist to leverage the power of SQL at scale (osqueryd is a full operating system instrumentation tool which allows you to use SQL to instrument your whole infra): https://github.com/facebook/osquery/wiki/using-osqueryd

All in all, WMI is great, no doubt about it, but osquery has a few unique features which make it a cool, interesting product that you can use all across you internal infrastructure.

👤marpaia🕑11y🔼0🗨️0

(Replying to PARENT post)

Since WMI is the Windows implementation of WBEM I had assumed there were ways to do WQL like stuff on other platforms already.
👤bryanrasmussen🕑11y🔼0🗨️0