For es_events and audit events, does it make more ...
# fleet
j
For es_events and audit events, does it make more sense to pull them in via snapshot or differential?