i think i know the answer to this, but let’s say i query etc_hosts every 30 minutes, so 1:00pm, 1:30pm, etc. then let’s say i edit etc_hosts as 1:15pm — the corresponding osquery event will have a timestamp of 1:30pm because it doesn’t know when that file was changed, right?