there is table called windows_events in osquery and the events created originally in windows event channels are written into that table