Those events are stored in osquery when they take place (buffered in RocksDB), and then retrieved when you query against the table.