docs: def _osquery(sql, format='json'):
      '''
      Helper function to run raw osquery queries
      '''
      ret = {
          'result': True,
      }
  
      cmd = ['osqueryi'] + ['--json'] + [sql]
      res = __salt__['cmd.run_all'](cmd)
      if res['stderr']:
          ret['result'] = False
          ret['error'] = res['stderr']
      else:
          ret['data'] = salt.utils.json.loads(res['stdout'])
      log.debug('== %s ==', ret)
      return ret