hey all. when osquery writes entries (for example) of running procs, it logs an "action: added" record and then a "action: removed" record once the proc is killed. is there any way to "tag" these records so that both the added & removed records have the same identifier? i need to query the data and basically negate all "removed" records