@Keith Shum Someone else reached out to me with a similar issue recently. Does it work if you use osquery 2.11.2? I think a breaking change may have been introduced at some point. Please file an issue with any information you can provide.