Also, for events that have own times attached (for example,

columns.time

on

logged_in_users

), do you replace the osquery timestamp with

columns.time

so that it reflects the actual time the event occurred?