@alessandrogario yea thats fine, I’m just curious how to get it going since the flag doesn’t seem to be in the code. If I enable it in the osquery.conf file, it can’t interpret it (maybe I am doing something wrong?).