@Kemal quite a few of your questions seem focused around Kolide configs. Try to keep Kolide related questions in the #C1XCLA5DZ channel. As for your question about Windows event logs, we get all of the information from the ETW trace, and we recursively process the XML body of the event, so there shouldn’t be any data loss, but if you feel there is go ahead and open an issue with repro steps