And I should clarify that the above statement that no data is stored is not completely true. There are 2 cases in which osquery does store data: 1. Event-based tables (see file_events, hardware_events, etc.) 2. When queries are run in "differential mode" (the default) in osqueryd the results are stored so that only diffs are logged