@Vibhor If the events are stored and you manage them, it is definitely possible to work with both events table, but if I understand correctly, it means you will have to implement the join yourself. As I see it, joining two events table in one query and scheduling it in osqueryd directly will not be sufficient. If I understand it wrong, please explain where is my misunderstanding.