I can't query windows event logs, osquertyi just says: "W1025 05
2338.988976 11352 virtual_table.cpp:968] Table windows_events is event-based but events are disabled
W1025 05
2338.988976 11352 virtual_table.cpp:975] Please see the table documentation:
https://osquery.io/schema/#windows_events" which is completely unhelpful as I follow the link and it's just a schema for the table... it doesn't tell me how to enable events, nor can I find anywhere how to do so. I tried the flag --windows_event_channels=System,Application,Setup,Security to "subscribe" to those event channels but it didn't do anything, most likely because as the error message says... events are not enabled. Cannot find how to enable them.