https://github.com/osquery/osquery logo
Title
l

Loy Glenn

08/20/2019, 6:08 PM
FYI all - if you don't see all of the DELETE events that you believe should exist in the win_file_events table, be sure that it really is a deletion and not a file being moved to the recycle bin. For more information, see the snippet in this thread.
👍 1