Hi everyone, does osquery does not give real-time data for windows as mentioned in this blog https://blog.trailofbits.com/2017/12/21/osquery-pain-points/ ?

Since the time of this article, osquery has gained a table called

ntfs_journal_events

for limited file event capability on Windows. It also gained a table

process_etw_events

for process events.

Also

windows_events