Yeah, that’s schedule based. On windows, you can also leverage the windows event logs table, and turn on a bunch of the secure auditing GPOs, and you can get tables similar to process events and such