@ventura you should try adding the flag --logger_snapshot_event_type=true in osquery.flags file (if you are adding your flags into this file) I’m using windows_events table with that flag and I don’t get the same logs each time, I get only new ones generated after the last query