osquery differential results

osquery differential results. Scheduled query differential results describe rows added or removed relative to the query’s prior state.

Source and collection

Configured logger destination, commonly osqueryd.results.log; not the INFO status log.

Review the scheduled SQL, interval, host identifier and differential versus snapshot mode.

Native example and provenance

publisher documentation example. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — preformatted example 6

One complete record selected; values unchanged.

Download the exact sample · Offline research kit

SHA-256: 09436c141a9bcdc9adde91df59d9b5b17ad2af4b37541614fb293f51a837a84d

{
  "action": "added",
  "columns": {
    "name": "osqueryd",
    "path": "/opt/osquery/bin/osqueryd",
    "pid": "97830"
  },
  "name": "processes",
  "hostname": "hostname.local",
  "calendarTime": "Tue Sep 30 17:37:30 2014",
  "unixTime": "1412123850",
  "epoch": "314159265",
  "counter": "1",
  "numerics": false
}

Structure and field interpretation

Observed structure in this specific sample
Field/path	Serialized type
`action`	str
`columns.name`	str
`columns.path`	str
`columns.pid`	str
`name`	str
`hostname`	str
`calendarTime`	str
`unixTime`	str
`epoch`	str
`counter`	str
`numerics`	bool

action: added, removed or snapshot semantics depend on logger mode.
columns: Result values from the scheduled SQL; values are commonly strings.
name: Scheduled query name.
unixTime: Event time represented as epoch seconds.

Investigation uses

Investigate a new process or configuration row with its query name and schedule.
Keep removed and added results together when evaluating state changes.

Validation boundaries

A scheduled process-table query can miss short-lived processes. An added row is a state delta, not automatically a real-time creation event.

This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Ecosystem connections

References

Logging - osquery

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.