Hi everyone, I'm trying to get a better understanding of how osquery accesses the Windows Event Log pipeline. Can someone please explain me how the following windows-specific classes interact with each other (see https://github.com/osquery/osquery/tree/master/osquery/events/windows)? • evtsubscription{.h/.cpp} -> responsible for subscribing to events with the Win32 API (push subscription) • windowseventlogparser{.h/.cpp} -> utility class that parses a Windows event log XML provided by evtsubscription • windowseventlogparserservice{.h/.cpp} -> continous service that uses evtsubscription to subscribe to event logs; parses the events with windowseventlogparser • windowseventlogpublisher{.h/.cpp} -> publishes the events collected in the windowseventlogparserservice in osquery tables? Do I have parts of this correct or what is the intended data flow between these classes? Thanks for any help in advance!