From the testing I've done to this point, I think ...
# general
j
From the testing I've done to this point, I think it is because we've set:
Copy code
"disable_audit": "false",
in the configuration file for osquery and looking for independent validation.