Check out the documentation regarding

_events

&

_changes

tables when using

osqueryi

. https://osquery.readthedocs.io/en/stable/development/pubsub-framework/#query-and-table-usage