Hello, we're having a problem with partially dupli...
# general
d
Hello, we're having a problem with partially duplicate results coming from osquery. We've read the docs on how "differential results" work but would like to understand a little better. Specifically, were trying to get only differential results (new changes). For example, a slow changing result set like user accounts will only have a hand full of results (original snapshot, added + differential changes, added/removed) over time. What's the required parameters and configurations to achive this?