docs: def _osquery_cmd(table, attrs=None, where=None, format='json'):
      '''
      Helper function to run osquery queries
      '''
      ret = {
          'result': True,
      }
  
      if attrs:
          if isinstance(attrs, list):
              valid_attrs = _table_attrs(table)
              if valid_attrs:
                  for a in attrs:
                      if a not in valid_attrs:
                          ret['result'] = False
                          ret['comment'] = '{0} is not a valid attribute for table {1}'.format(a, table)
                          return ret
                  _attrs = ','.join(attrs)
              else:
                  ret['result'] = False
                  ret['comment'] = 'Invalid table {0}.'.format(table)
                  return ret
          else:
              ret['comment'] = 'attrs must be specified as a list.'
              ret['result'] = False
              return ret
      else:
          _attrs = '*'
  
      sql = 'select {0} from {1}'.format(_attrs, table)
  
      if where:
          sql = '{0} where {1}'.format(sql, where)
  
      sql = '{0};'.format(sql)
  
      res = _osquery(sql)
      if res['result']:
          ret['data'] = res['data']
      else:
          ret['comment'] = res['error']
      return ret