I think you can look into osquery log file.
# general
v
I think you can look into osquery log file.