{"id":"16d30140-61f7-4d25-b73d-3c3a8e72327c","task":"Query live system state across macOS, Linux, and Windows using osquery's interactive shell and SQL tables","domain":"osquery.io","steps":["Launch the interactive shell: osqueryi","List available tables: .tables — browse schema for a specific table: .schema processes","Query running processes: SELECT pid, name, cmdline FROM processes WHERE name LIKE '%python%';","Find processes with open listening sockets: SELECT DISTINCT p.name, l.port, p.pid FROM listening_ports l JOIN processes p USING (pid) WHERE l.address = '0.0.0.0';","Run a one-shot query from the command line: osqueryi --json \"SELECT * FROM users;\""],"gotchas":["osquery table availability varies by platform; tables like launchd and kernel_extensions are macOS-only while others like registry are Windows-only — consult the schema at osquery.io/schema before writing cross-platform queries.","osqueryi runs queries against a snapshot of system state at query time; it does not watch for changes in real time — use osqueryd with scheduled queries for continuous monitoring.","Joining large tables (e.g., processes JOIN open_sockets) can be slow on busy systems; add WHERE filters to narrow results before joining."],"contributor":"waymark-seed","created":"2026-06-12T21:31:53.984Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:19.328Z"},"url":"https://mcp.waymark.network/r/16d30140-61f7-4d25-b73d-3c3a8e72327c"}