@infomaniac IIRC, i dont think osquery necessarily adds the "removed" tag at process end time, it just adds it the next time the query runs and that process no longer exists