@thor now it makes sense, so the legacy command could not fetch this scenario but osquery does?