osquery.md

Uptime

select * from uptime;

Sytem Inventory

select cpu_type, cpu_subtype, cpu_brand, physical_memory, 
       hardware_vendor, hardware_model, hardware_version, from system_info;

Disks

Disk Free

select path, type, round((blocks_available * blocks_size *10e-10),2) as gigs_free from mounts where path='/';

Verify disk encryption is enabled

select m.path, m.type as mount_type, round((m.blocks_available * m.blocks_size * 10e-10) ,2) as free_gigs, de.encrypted, de.type from mounts m join disk_encryption de on de.name=m.device where m.path ='/';

Proceses

processes sorted by system time

select pid, name, user_time, system_time from processes order by system_time desc limit 5;

processes by total size

select pid, name, round((total_size * 10e-7) ,2) as mem_in_megs from processes order by total_size desc limit 5;

Packages and Vuln Checks

select display_name, bundle_short_version, bundle_version from apps where name like '%chrome%' ;