This looks to be coming off a fairly mundane looking:

"queries": {
        "file_events_linux": {
          "query": "SELECT * FROM file_events;",
          "removed": true,
          "version": "",
          "interval": 300,
          "platform": "linux",
          "description": ""
        }