The blog post by the team that did the port (Trail of Bits), mentions that it uses wmi and shims the data into osquery. https://blog.trailofbits.com/2016/09/27

The blog post by the team that did the port (Trail of Bits), mentions that it uses wmi and shims the data into osquery. https://blog.trailofbits.com/2016/09/27/windows-network-security-now-easier-with-osquery/ https://blog.trailofbits.com/2016/09/27/windows-network-secu...