I also notice two things : the "time" field is not that of when the command was issued (curl) but rather when osqueryd processed it (14:22, 4 minutes ago, but the commands were run much earlier).