Helper function to run osquery queries

def _osquery_cmd(table, attrs=None, where=None, format='json'):
    '''
    Helper function to run osquery queries
    '''
    ret = {
        'result': True,
    }

    if attrs:
        if isinstance(attrs, list):
            valid_attrs = _table_attrs(table)
            if valid_attrs:
                for a in attrs:
                    if a not in valid_attrs:
                        ret['result'] = False
                        ret['comment'] = '{0} is not a valid attribute for table {1}'.format(a, table)
                        return ret
                _attrs = ','.join(attrs)
            else:
                ret['result'] = False
                ret['comment'] = 'Invalid table {0}.'.format(table)
                return ret
        else:
            ret['comment'] = 'attrs must be specified as a list.'
            ret['result'] = False
            return ret
    else:
        _attrs = '*'

    sql = 'select {0} from {1}'.format(_attrs, table)

    if where:
        sql = '{0} where {1}'.format(sql, where)

    sql = '{0};'.format(sql)

    res = _osquery(sql)
    if res['result']:
        ret['data'] = res['data']
    else:
        ret['comment'] = res['error']
    return ret