quick question... I am just now starting to leverage the output results of the scheduled queries (

/var/log/kolide/osquery_result.log

.... What field can I zero in on to identify detections?