@OMAR this is osqueryd right? and it’s a differential query? and each time the query runs it dumps the full set of results?