Has anything been changed with the file_events table? We're getting alerts that

/etc/sudoers

has had ATTRIBUTES_MODIFIED on pretty much every instance. According to osquery, /etc/sudoers was modified Wed Oct 16 004208, but looking at the actual file I see that it hasn't been modified since May

ls -l /etc/sudoers
-r--r----- 1 root root 790 May 10 11:54 /etc/sudoers