user
<https://github.com/osquery/osquery/commit/e0153cccecf4d25088f68ed4a7fd11068eeb3346|e0153cc>
packs/incident_response