Hi in osquery I am seeing the PROC_CREATE event is showing the owner_uid but the actual FILE_WRITE event is only showing UID. In case the file is written or modified with Admin priviliges I cannot identify which user is making the actual change. Only that is was done by NT AUTHORITY\\SYSTEM or BUILTIN\\Administrators. Any way to correlate or change it so that FILE_WRITE events also start showing the owner_uid ?