osquery-helper_skill

Overview

This skill helps you write, validate, and troubleshoot osquery SQL queries using the authoritative table schemas provided for a chosen EDR platform. It produces accurate, performance-minded queries and explains schema lookups, assumptions, and limitations. Responses are grounded only in the extracted schema definitions for the selected platform.

How this skill works

I inspect the provided osquery schema files for the declared platform and extract full table definitions and column lists using the included helper scripts. Based on the requested goal (write, validate, or troubleshoot) I verify table and column existence, check OS compatibility, flag performance issues, and produce corrected or optimized SQL along with the grep/extraction commands used.

When to use it

• You need a new osquery query for incident response or threat hunting.
• You want to validate an existing query against the platform-specific schema.
• A query is failing or returning unexpected results and needs troubleshooting.
• You need performance or accuracy improvements for an osquery query.
• You want clear evidence of which schema tables/columns support a query.

Best practices

• Treat the schema as authoritative: only use columns and tables confirmed by grep/extraction.
• Always check OS compatibility for each table via platforms(...) or #platform markers.
• Favor WHERE clauses, LIMIT for exploration, avoid SELECT * and minimize JOINs.
• Use placeholders (e.g., '<path_to_file>', '<username>') and redact sensitive data in examples.
• Report assumptions and limitations explicitly (missing columns, EDR differences).

Example use cases

• Write an osquery query to find recently modified executables for Windows using EDR-specific tables.
• Validate a provided query to ensure all referenced columns exist on macOS and suggest fixes.
• Troubleshoot a failing query by checking platform markers and spelling of table/column names.
• Optimize a broad query by adding targeted WHERE predicates and reducing JOINs.
• Map a cross-platform hunt to the correct per-OS tables using schema lookups.