ah, i gotcha. FWIW, fleet has that logic built-in out of the box, it might be interesting to look at the code to see what attributes they use to classify “new”, but i imagine it’s separate from the actual osquery result logs