Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

<@UA0CRPC0N> any `_events` tables will be collecting events as long as `osqueryd` is running, and then when you query them you will get all the events since the last query was executed.

Yes, we have already been using windows_events table. Sorry for this but i think i couldn't explain the situation exactly.  What i asked for is about non-event based tables. For example when i query usb_events table periodically, the result of the query doesn't contain the events/logs which generated between the any two queries

Ah, sorry this table is also an event based table. 

You can imagine the table as a non-event based table

Is there a `usb_events` table? I can only find `usb_devices` which is not event based. There is also `hardware_events` which is event based.

Please consider the that table as for my question.  Usb_devices...

`usb_devices` gives you the state when the query is run