Here is the current list of Orbital queries that Device Insights uses for reference.
-- users
SELECT username AS localUsername
FROM users
WHERE type == "local";
-- logged_in_users
SELECT user AS loggedInUser
FROM logged_in_users
WHERE user != "";
-- time
SELECT
timezone,
local_timezone
FROM time;
-- certificates
SELECT
common_name,
subject,
issuer,
ca
FROM certificates;
-- registry
SELECT
firewall AS "firewall",
autoupdate AS "autoupdate",
antivirus AS "antivirus",
antispyware AS "antispyware",
internet_settings AS "internet_settings",
windows_security_center_service AS "windows_security_center_service",
(SELECT
CASE
WHEN DATA = 1 THEN "Good" ELSE "Poor"
END AS user_account_control
FROM registry
WHERE PATH = "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA"
) AS "user_account_control"
FROM windows_security_center;
-- windows_security_products
SELECT *
FROM windows_security_products;
-- bitlocker_info
SELECT *
FROM bitlocker_info
-- Win32_DeviceGuard
SELECT
AvailableSecurityProperties,
CodeIntegrityPolicyEnforcementStatus,
RequiredSecurityProperties,
SecurityServicesConfigured,
SecurityServicesRunning,
UsermodeCodeIntegrityPolicyEnforcementStatus,
VirtualizationBasedSecurityStatus
FROM Win32_DeviceGuard;
-- drivers
SELECT
device_id,
device_name,
description,
provider,
signed
FROM drivers;
-- registry
SELECT
key AS reg_key,
path,
name,
data,
DATETIME(mtime, "unixepoch", "UTC")
FROM registry
WHERE (
key LIKE "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sharedaccess\parameters\firewallpolicy\%profile" OR
key LIKE "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sharedaccess\parameters\firewallpolicy\%profile" OR
key LIKE "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sharedaccess\parameters\firewallpolicy\%profile" OR
key LIKE "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\%profile"
) AND
name LIKE "EnableFirewall";
-- system_info
SELECT
uuid,
hostname,
hardware_vendor,
hardware_model,
hardware_version,
hardware_serial,
computer_name,
local_hostname
FROM system_info
-- registry
SELECT
name,
key,
data
FROM registry
WHERE
key LIKE "HKEY_CLASSES_ROOT\Installer\Products\%%" AND
(
data LIKE "%%DUO%%" OR
data LIKE "%%AMP%%" OR
data LIKE "%%AnyConnect%%"
);
-- registry
SELECT SUBSTR(data, -24, 24) AS sid
FROM registry
WHERE
key = "HKEY_LOCAL_MACHINE\SECURITY\SAM\Domains\Account" AND
name == "V";
