@Mustafa ah that could be, have you verified you don’t get duplicate events with the latest stable tag?

with 3.2.9 both table are generating duplicate events (windows_events and powershell_events… for windows_events table i use the flag in my flag file windows_event_channels=Microsoft-Windows-PowerShell/Operational)