Introducing #osqtool v1.0: https://github.com/chainguard-dev/osqtool
It's a swiss-army tool for testing, creating, and manipulating #osquery query packs.
Got a directory full of SQL files and want to archive it into a query pack?
`osqtool pack <directory>`
want to ensure that none of the queries in it will consume more than 15 minutes across a day of querying by multiplying the interval vs runtime duration?
`osqtool -max-query-daily-duration=15m verify <pack|directory>`
Go forth and enjoy!