i e event timestamps are tied to when osquery saw the change osquery #general

i.e. event timestamps are tied to when osquery saw...

clong

10/04/2017, 5:04 AM

i.e. event timestamps are tied to when osquery saw the change, not when the change happened?