for example `osqueryd` can tell you what's changed...
# general
g
for example
osqueryd
can tell you what's changed in the last 30 minutes with
select * from usb_devices;
osqueryi can only tell you what it sees at the moment you run that query