def xattr_where_from(attrs=None, where=None):
    '''
    Return xattr_where_from information from osquery

    CLI Example: