Some example queries: https://fleetdm.com/queries

The formula osquery uses to report performance: https://github.com/fleetdm/fleet/issues/16123