// Help users write, validate, and troubleshoot osquery SQL queries using provided osquery table schemas as the authoritative source.
| name | osquery-query-helper |
| description | Help users write, validate, and troubleshoot osquery SQL queries using provided osquery table schemas as the authoritative source. |
Help users with all aspects of osquery query work:
All work is grounded in the tables and columns defined in the provided schema files for the specified EDR platform.
Schema files are located in resources/ and named by EDR platform: <platform>_osquery_schema.spec
standard_osquery_schema.spec — Baseline vanilla osquery (default when no platform specified)bitdefender_, kolide_, crowdstrike_, sentinelone_, carbonblack_To discover available platforms:
ls resources/*_osquery_schema.spec 2>/dev/null || ls resources/*.spec
Schema files use one of two formats to indicate OS compatibility:
platforms([...]) fieldtable_name("<table_name>")
description("Brief description.")
schema([
Column("column_name", TYPE, "Column description")
])
implementation("<table_name>@genTable")
platforms(["darwin", "linux", "windows"])
#platform marker before table definitionsA platform marker on its own line applies to all tables until the next marker:
#darwin
table_name("<mac_only_table>")
...
#linwin
table_name("<linux_windows_table>")
...
| Marker | Platforms |
|---|---|
#darwin | macOS only |
#linux | Linux only |
#windows | Windows only |
#linwin | Linux and Windows |
#macwin | macOS and Windows |
#posix | macOS, Linux, FreeBSD |
#sleuthkit | macOS, Linux (requires The Sleuth Kit) |
#utility | Cross-platform utility tables |
#cross-platform | All supported platforms |
The schema files are large. Always follow the workflow below to extract table definitions.
Helper scripts are provided in scripts/ to simplify complex operations:
scripts/detect-format.sh - Determines schema formatscripts/extract-table.sh - Extracts complete table definitions# Search by table name keyword
grep -i 'table_name(".*<keyword>' "$SCHEMA_FILE"
# Search descriptions for concepts
grep -i 'description(".*<concept>' "$SCHEMA_FILE"
Use the extraction script to get the complete table definition:
bash scripts/extract-table.sh <schema_file> <table_name>
Example:
bash scripts/extract-table.sh resources/standard_osquery_schema.spec processes
The script automatically:
#platform marker for Format 2 schemasIf you need to check the format manually:
bash scripts/detect-format.sh <schema_file>
# Returns: "platforms_array" or "platform_markers"
schema([...]) blockplatforms([...]) field or preceding #platform markerWHERE clauses, use LIMIT for exploration, avoid SELECT *, minimize JOINs'<path_to_file>', '<username>', '<timestamp>', '<ip_address>'Ask user or check context. Default to standard_osquery_schema.spec if unspecified.
Writing new query? Validating? Troubleshooting? What data is needed?
Use grep to find tables, then bash scripts/extract-table.sh to get full definitions. Verify columns and OS compatibility from the extracted output.
Use only verified tables/columns. Add WHERE clauses and LIMIT for performance.
Include:
Apply the NATO Admiralty System (AJP-2.1) to assess source reliability and information credibility in cyber threat intelligence, OSINT, and breach analysis. Use this skill whenever you need to evaluate a CTI report, breach claim, dark web forum post, threat actor advertisement, vendor blog, social media intel claim, leaked database listing, or any source plus information pair where trust matters. Trigger phrases include "assess this source", "rate this report", "is this breach real", "evaluate credibility", "source assessment", "should I trust this claim", "admiralty rating", "A1 to F6", and any review of CTI or OSINT material where you need to decide how much weight to give it. Use proactively when the user shares a breach post, threat actor claim, or vendor report and asks for analysis, even if they do not explicitly mention the Admiralty System. Also use when teaching, building courseware, or producing a training example around source evaluation.
Build structured threat actor profiles using the 5W1H framework and the Diamond Model. Use this skill whenever the user wants to profile a threat actor, create a TA report, analyze an APT group, build an adversary profile, assess threat actor capability, map TTPs to MITRE ATT&CK for a specific group, or produce any intelligence deliverable about a threat actor. Also trigger when the user mentions threat actor names (e.g. APT29, Lazarus, FIN7), asks about victimology, modus operandi, or wants to structure threat intelligence around an adversary. This skill applies to both internal tracking profiles and incident-driven analytical deliverables.
Professional malware analysis workflow for PE executables and suspicious files. Triggers on file uploads with requests like "analyze this malware", "analyze this sample", "what does this executable do", "check this file for malware", or any request to examine suspicious files. Performs static analysis, threat intelligence triage, behavioral inference, and produces analyst-grade reports with reasoned conclusions.
Analyse Mitre ATT&CK tactics, techniques and sub-techniques. Use when performing analysis of threat detections, threat models, security risks or cyber threat intelligence
Create a targeted intrusion timeline for a Windows incident using whatever artifacts are available (event logs, EDR, SIEM exports, triage notes).
Hypothesis-driven hunt plan for suspicious PowerShell, plus query snippets for common telemetry.