this should be good to go : https://github.com/osquery/osquery/pull/5972

Responded with another comment about the cool-down between scans. This also exists in

virtual_table.cpp

for joins/etc. We could use the same flag or have a

--yara_delay

.