you can tell which tables can stream events because they have a three-layer 'database'-y icon here https://osquery.io/docs/tables/