<!-- .slide: class="content" --> ## Review And Summary * Event queries never terminate! Instead they stream results in real time. * Event queries on the endpoint can be used for monitoring and detection. * Event queries on the server can be used for automation --- <!-- .slide: class="content" --> ## Review And Summary * Velociraptor's process tracker is used on the end point to enrich process information with context that is critical for understanding where a process came from.