The nice thing osquery can have is disconnecting what's currently turned on and connected this second from what records you're getting back. OSquery can pump r

The nice thing osquery can have is disconnecting what's currently turned on and connected this second from what records you're getting back. OSquery can pump results into a DB that you look through, WMI I've got to check for myself what's turned on, did it all report etc. A driver for wmi in osquery would be a great addition.