Got it working. It's actually "decorations_top_lev...
# general
p
Got it working. It's actually "decorations_top_level" . osquerydocs need to be updated.