Hey everyone, I haven't been able to answer this in the documentation. When we run a differential query how long back does OSquery keep track of the previous results? Is it just the previous run? Is it 24 hours? Also where is that state stored? Locally on each system?

You can find documentation here: https://osquery.readthedocs.io/en/latest/deployment/logging/#differential-logs, where it mentions that it's always between the previous run and the current run. So it only stores one run, and it does so in RocksDB, locally.

Thank you @Stefano Bonicatti is there a way to extend that window?

No you can't, but I also wonder to what end?

My usecase would be I only want to get new connections. I don't care if my host is always connecting to another server continuously. In this set up I will not get the connection every other query run. I was looking more for I only get this network connection once