hey folks, got a thought on incident response aspect of query building which i am working on at the moment. A lot of IR queries tend to be overall data collection you'd do when looking for an indication of compromise. Let's take an example, /etc/hosts has a new entry for a site or something has been installed and restarted by cron or something along those lines.