The supplement has the paper and some other papers done with the tools described in the paper.
I like the “eject” idea, it’s a succinct way of phrasing an friction I often have with tools that wrap something more flexible.
I first heard the phrase “eject” used in the context of ejecting a Webpack config from a Create React App application’s autoconfig. It may go back further.
yeah that IS neat
Has anyone ever heard of something like this - SQL for the OS, but run against a sos report?
I always seem to be using the awk/grep/etc… to explore things ad-hoc.
I did find jc + sqlite-utils to be interesting, but seemed a waste to not leverage all the table definitions from OSQuery.