In the last release of extension, we added a feature to index the disk to make file searches easier on the disk (over and above what 'file' table provides) thru a new table. If interested on how it helps with threat hunt: https://medium.com/eclecticiq/hunting-emotet-made-easy-with-eclecticiq-endpoint-response-caef410772c8