@JoSeiler that looks correct. windowseventlogpublisher set ups everything and calls into some of those classes to have the parser service process the events, then when there are events that have been processed, it publishes them to the subscribers (osquery own EventSubscriber class), which represent the evented tables (a table inherit from it and provides its specific implementation).