@theopolis that's a really good question actually. Because when running from osqueryi, I get the proper results back