osquery: what one result row is evidence of

The row is only the columns you asked for

osqueryi answers the statement you typed and then forgets it. The grid on screen is not a host record the tool stored. If the statement did not name a column, that grid cannot support a sentence about it. A blank cell is different again: the column was requested and the table returned an empty value.

The process name is a label. Two rows can share it and be different programs. The path, the start time, and the user id are separate columns. Cite only the ones that appear in the output you keep.

The shell does not stamp the question

Nothing in a pasted grid says which machine you were on, or at what UTC time you asked, unless you typed those into the statement or wrote them beside it. A later reader cannot repeat the question from a name and a pid alone. Those values may already belong to another process.

Write three lines with every grid you keep: the host name you connected to, the UTC time you ran the statement, and the statement itself. Then the grid.

host: lab-web-02
ran_at: 2026-11-03T15:12:04Z
sql: SELECT pid, name, path, start_time FROM processes WHERE name = 'python3';

Text the process was showing then

A command-line column is the argument text osquery read at that moment. It is not a sealed copy of how the process was started, and it is not a verdict. If the finding needs the file that is running, cite path and, when the file is still on disk, a hash you selected in the same sitting. Say so when you did not.

Worked case: two rows with one name

A lab query that selects only name and pid returns two python3 rows on lab-web-02. The draft calls both “the lab service.” The statement never asked for path. Rerun with path and start_time. One path is /usr/bin/python3, started at boot with the system interpreter. The other is /opt/lab/check.py, started during the exercise hour.

The note quotes the second statement, the UTC time, and only the /opt/lab/check.py row. It does not describe the interpreter row as the exercise. The first grid, names and pids alone, stays in the scratch file and is not cited.