Editing OSQuery (section)

=== Find out what tables are available ===
As mentioned, Osquery makes data available as the output of SQL queries. Information in databases is often saved in tables. But how can you query these tables if you don't know their names? Well, you can run the .tables command to list all the tables that you can query. If you are a long-time Linux user or a sysadmin, the table names will be familiar, as you have been using operating system commands to get this information:
 osquery> .tables
 
  => acpi_tables
  => apparmor_events
  => apparmor_profiles
  => apt_sources
 << snip >>
  => arp_cache
  => user_ssh_keys
  => users
  => yara
  => yara_events
  => ycloud_instance_metadata
  => yum_sources

osquery>