https://github.com/facebook/osquery/blob/master/specs/windows/windows_events.table windows_events table dosnt contain the channel column “select * from windows_events where eventid=4104 and channel=‘Security’“,