Hmm… One dumb question. When I got an alert on

ATTRIBUTES_MODIFIED

, all hashes were missing. Does it mean osquery is not monitoring via hash changes?