also if you have a stack exchange account you can make this person's day https://stackoverflow.com/questions/64481969/why-osquery-does-not-include-computer-event-information-when-reading-windows-e

quick way to generate some Windows events?

Nevermind, got it. My problem was that you have to explicitly enable the event subscriber and publisher with osquery flags:

osqueryi.exe --disable_events=false --windows_event_channels="System,Application,Setup,Security" --enable_windows_events_publisher=true --enable_windows_events_subscriber=true

Yea, so I tested with it a bit and it works for me (

windows 10

)

i am happy to test it in several environments when ready

I was watching the office hours video, wondering if we will be lucky enough to get this through in 4.7.0?

@Juan Alvarez would love to see it in 4.7 as well, we will see