there is a nice article about windows_events here ...
# general
s
there is a nice article about windows_events here https://osquery.io/blog/configuring-windows-process-event-auditing