ok the key is something like events data auditeventpublisher osquery #general

ok, the key is something like: events[data.audite...

vaar

05/05/2018, 9:17 PM

ok, the key is something like: events[data.auditeventpublisher.process_events.0000000001]