general question, how quickly should something show up in an osquery taable?
04/21/2020, 5:25 PM
Most osquery tables are generated at the time of the query. So results will show up immediately. Tables that end with "_events" have events stored in an internal store. Those will also be available essentially immediately.