@Mike Myers:

timestamp_observed

is the time the query was ran. The query on the host is just:

SELECT * FROM processes

. I stripped all other columns for readability. After further investigating I came to the conclusion that this behaviour is due to process being suspended or the system going to sleep. Once the process is resumed it gets a new

start_time

value. The operating system in the example was Windows 10. I imagine this is just how Windows works, so I haven't given in much more thought. It is a bit annoying that this creates duplicated entries in our DB, but I can live with that.