I've been working on Osquil, a schema-aware workbench for osquery. The first version is close, and before I publish it I want feedback from people who actually use osquery.
If you've used osquery for more than a week, you probably know the drill. You open osqueryi, type .tables, and stare at 200+ table names with no autocomplete, no column hints, and no clear idea what half of them return until you SELECT * and hope. You Google "osquery processes table columns" again. If you need to share results, you end up copying output around or piping it into something else.
osquery itself is great. Turning the OS into a queryable database is still one of the better ideas in security tooling. But writing queries against it often feels rougher than it needs to, especially when you're moving between tables, docs, and terminal output.
So I started building Osquil around the thing that kept slowing me down: the schema.
The editor knows the schema
