diff --git a/artifacts/definitions/Linux/Events/DNS.yaml b/artifacts/definitions/Linux/Events/DNS.yaml
new file mode 100644
index 00000000000..013502f5a60
--- /dev/null
+++ b/artifacts/definitions/Linux/Events/DNS.yaml
@@ -0,0 +1,52 @@
+name: Linux.Events.DNS
+description: |
+  This artifact uses eBPF to track DNS requests from various processes.
+
+  NOTE: This event is generated from network traffic - it is unable to
+  view DoH traffic.
+
+type: CLIENT_EVENT
+
+precondition: |
+  SELECT OS From info() where OS = 'linux'
+
+parameters:
+  - name: ExcludeDestIP
+    description: Only show events with a different DestIP
+    type: regex
+    default: "Change this to your default DNS Server IP"
+  - name: Records
+    description: Only show events matching these DNS records
+    type: regex
+    default: .
+  - name: ProcessNameFilter
+    description: Filter Events by Process Name
+    type: regex
+    default: .
+  - name: IncludeDNSDetails
+    type: bool
+    description: If set we include more details like HTTP Headers
+  - name: IncludeProcessInfo
+    type: bool
+    description: If set we include more process information.
+
+sources:
+  - query: |
+      SELECT System.Timestamp AS Timestamp,
+             System.ProcessName AS ProcessName,
+             System.ProcessID AS Pid,
+             if(condition=IncludeProcessInfo,
+                then=process_tracker_get(id=System.ProcessID).Data) AS ProcessInfo,
+             EventData.src AS src_ip,
+             EventData.src_port AS src_port,
+             EventData.dst AS dest_ip,
+             EventData.dst_port AS dest_port,
+             EventData.proto_dns.questions.name AS name,
+             EventData.proto_dns.questions.type AS type,
+             EventData.proto_dns.answers.IP AS IP,
+             if(condition=IncludeDNSDetails,
+                then=EventData) AS _DNSData
+      FROM watch_ebpf(events="net_packet_dns")
+      WHERE NOT dest_ip =~ ExcludeDestIP
+        AND if(condition=Records, then=EventData.proto_dns =~ Records, else=TRUE)
+        AND ProcessName =~ ProcessNameFilter
diff --git a/artifacts/definitions/Linux/Events/EBPF.yaml b/artifacts/definitions/Linux/Events/EBPF.yaml
index 2e2dd27a1f2..6bc47dba4f2 100644
--- a/artifacts/definitions/Linux/Events/EBPF.yaml
+++ b/artifacts/definitions/Linux/Events/EBPF.yaml
@@ -13,7 +13,6 @@ parameters:
     type: csv
     default: |
       Event,Desc,Enabled
-      accept4,A process accepted a connection from remote,Y
       bpf_attach,A bpf program is attached,Y
       chdir,Process changes directory,N
       fchownat,File ownership is changed,Y
diff --git a/artifacts/definitions/Linux/Events/HTTPConnections.yaml b/artifacts/definitions/Linux/Events/HTTPConnections.yaml
new file mode 100644
index 00000000000..cef9dd4901e
--- /dev/null
+++ b/artifacts/definitions/Linux/Events/HTTPConnections.yaml
@@ -0,0 +1,55 @@
+name: Linux.Events.HTTPConnections
+description: |
+  This artifact uses eBPF to track HTTP and parse connections from
+  various processes.
+
+  NOTE: This event is generated from network traffic - it is unable to
+  view TLS encrypted data.
+
+  If the process tracker is enabled we also show more information
+  about the process.
+
+type: CLIENT_EVENT
+
+precondition: |
+  SELECT OS From info() where OS = 'linux'
+
+parameters:
+  - name: HostFilter
+    description: Filter Events by Host header
+    type: regex
+    default: .
+  - name: URLFilter
+    description: Filter Events by URL
+    type: regex
+    default: .
+  - name: ProcessNameFilter
+    description: Filter Events by Process Name
+    type: regex
+    default: .
+  - name: IncludeHeaders
+    type: bool
+    description: If set we include more details like HTTP Headers
+  - name: IncludeProcessInfo
+    type: bool
+    description: If set we include more process information.
+
+sources:
+  - query: |
+      SELECT System.Timestamp AS Timestamp,
+             System.ProcessName AS ProcessName,
+             System.ProcessID AS Pid,
+             if(condition=IncludeProcessInfo,
+                then=process_tracker_get(id=System.ProcessID).Data) AS ProcessInfo,
+             EventData.metadata.src_ip AS src_ip,
+             EventData.metadata.src_port AS src_port,
+             EventData.metadata.dst_ip AS dest_ip,
+             EventData.metadata.dst_port AS dest_port,
+             EventData.http_request.host AS host,
+             EventData.http_request.uri_path AS uri_path,
+             if(condition=IncludeHeaders,
+                then=EventData.http_request) AS _HTTPRequest
+      FROM watch_ebpf(events="net_packet_http_request")
+      WHERE host =~ HostFilter
+        AND uri_path =~ URLFilter
+        AND ProcessName =~ ProcessNameFilter
diff --git a/artifacts/definitions/Linux/Events/TrackProcesses.yaml b/artifacts/definitions/Linux/Events/TrackProcesses.yaml
index 845691d5921..405a1409c04 100644
--- a/artifacts/definitions/Linux/Events/TrackProcesses.yaml
+++ b/artifacts/definitions/Linux/Events/TrackProcesses.yaml
@@ -1,6 +1,6 @@
 name: Linux.Events.TrackProcesses
 description: |
-  This artifact uses ebpfg and pslist to keep track of running
+  This artifact uses ebpf and pslist to keep track of running
   processes using the Velociraptor process tracker.
 
   The process tracker keeps track of exited processes, and resolves
diff --git a/artifacts/definitions/Windows/NTFS/MFT.yaml b/artifacts/definitions/Windows/NTFS/MFT.yaml
index 23ce520655e..ed6d1aa9406 100644
--- a/artifacts/definitions/Windows/NTFS/MFT.yaml
+++ b/artifacts/definitions/Windows/NTFS/MFT.yaml
@@ -122,7 +122,7 @@ sources:
             LastModified0x10, LastModified0x30,
             LastRecordChange0x10, LastRecordChange0x30,
             LastAccess0x10,LastAccess0x30,
-            HasADS, SI_Lt_FN, uSecZeros, Copied,
+            HasADS, SI_Lt_FN, USecZeros, Copied,
             FileNames, FileNameTypes
         FROM parse_mft_version(filename=MFTPath,
                        accessor=Accessor, prefix=Drive)
@@ -140,7 +140,7 @@ sources:
             LastModified0x10, LastModified0x30,
             LastRecordChange0x10, LastRecordChange0x30,
             LastAccess0x10,LastAccess0x30,
-            HasADS, SI_Lt_FN, uSecZeros, Copied,
+            HasADS, SI_Lt_FN, USecZeros, Copied,
             FileNames, FileNameTypes
         FROM parse_mft_version(filename=MFTPath,
                        accessor=Accessor, prefix=Drive)
@@ -163,7 +163,7 @@ sources:
             LastModified0x10, LastModified0x30,
             LastRecordChange0x10, LastRecordChange0x30,
             LastAccess0x10,LastAccess0x30,
-            HasADS, SI_Lt_FN, uSecZeros, Copied,
+            HasADS, SI_Lt_FN, USecZeros, Copied,
             FileNames, FileNameTypes
         FROM parse_mft_version(filename=MFTPath,
                        accessor=Accessor, prefix=Drive)
@@ -187,7 +187,7 @@ sources:
             LastModified0x10, LastModified0x30,
             LastRecordChange0x10, LastRecordChange0x30,
             LastAccess0x10,LastAccess0x30,
-            HasADS, SI_Lt_FN, uSecZeros, Copied,
+            HasADS, SI_Lt_FN, USecZeros, Copied,
             FileNames, FileNameTypes
         FROM parse_mft_version(filename=MFTPath,
                        accessor=Accessor, prefix=Drive)
diff --git a/artifacts/testdata/server/testcases/mft.out.yaml b/artifacts/testdata/server/testcases/mft.out.yaml
index f38d4243436..39559a09418 100644
--- a/artifacts/testdata/server/testcases/mft.out.yaml
+++ b/artifacts/testdata/server/testcases/mft.out.yaml
@@ -21,7 +21,7 @@ LET _ <= remap(config=format(format=RemappingTemplate, args=[ srcDir+'/artifacts
   "LastAccess0x30": "2022-03-18T04:15:18.5166156Z",
   "HasADS": false,
   "SI_Lt_FN": false,
-  "uSecZeros": false,
+  "USecZeros": false,
   "Copied": true,
   "FileNames": [
    "just_a_file.txt"
@@ -52,7 +52,7 @@ LET _ <= remap(config=format(format=RemappingTemplate, args=[ srcDir+'/artifacts
   "LastAccess0x30": "2018-09-24T07:55:29.7664719Z",
   "HasADS": true,
   "SI_Lt_FN": false,
-  "uSecZeros": false,
+  "USecZeros": false,
   "Copied": false,
   "FileNames": [
    "Hello world text document.txt"
@@ -82,7 +82,7 @@ LET _ <= remap(config=format(format=RemappingTemplate, args=[ srcDir+'/artifacts
   "LastAccess0x30": "2018-09-24T07:55:29.7664719Z",
   "HasADS": true,
   "SI_Lt_FN": false,
-  "uSecZeros": false,
+  "USecZeros": false,
   "Copied": false,
   "FileNames": [
    "Hello world text document.txt:goodbye.txt"
@@ -113,7 +113,7 @@ LET _ <= remap(config=format(format=RemappingTemplate, args=[ srcDir+'/artifacts
   "LastAccess0x30": "2022-03-18T04:22:20.4341459Z",
   "HasADS": false,
   "SI_Lt_FN": false,
-  "uSecZeros": false,
+  "USecZeros": false,
   "Copied": false,
   "FileNames": [
    "another_file.txt"
@@ -143,7 +143,7 @@ LET _ <= remap(config=format(format=RemappingTemplate, args=[ srcDir+'/artifacts
   "LastAccess0x30": "2022-03-18T04:15:18.5166156Z",
   "HasADS": false,
   "SI_Lt_FN": false,
-  "uSecZeros": false,
+  "USecZeros": false,
   "Copied": true,
   "FileNames": [
    "just_a_file.txt"
@@ -174,7 +174,7 @@ LET _ <= remap(config=format(format=RemappingTemplate, args=[ srcDir+'/artifacts
   "LastAccess0x30": "2022-03-18T04:15:18.5166156Z",
   "HasADS": false,
   "SI_Lt_FN": false,
-  "uSecZeros": false,
+  "USecZeros": false,
   "Copied": true,
   "FileNames": [
    "just_a_file.txt"
diff --git a/artifacts/testdata/server/testcases/ntfs.out.yaml b/artifacts/testdata/server/testcases/ntfs.out.yaml
index 83f9ad8d2ae..ee59f74241b 100644
--- a/artifacts/testdata/server/testcases/ntfs.out.yaml
+++ b/artifacts/testdata/server/testcases/ntfs.out.yaml
@@ -24,7 +24,7 @@ LET NTFSInfoFromImage <= parse_ntfs( filename=srcDir+'/artifacts/testdata/files/
   "IsDir": false,
   "HasADS": true,
   "SI_Lt_FN": false,
-  "uSecZeros": false,
+  "USecZeros": false,
   "Copied": false,
   "SIFlags": "2080 (ARCHIVE,COMPRESSED)",
   "Created0x10": "2018-09-24T07:55:29.7664719Z",
diff --git a/artifacts/testdata/server/testcases/remapping.out.yaml b/artifacts/testdata/server/testcases/remapping.out.yaml
index 3c225ed96a2..56b617df103 100644
--- a/artifacts/testdata/server/testcases/remapping.out.yaml
+++ b/artifacts/testdata/server/testcases/remapping.out.yaml
@@ -45,7 +45,7 @@ LET _ <= remap(config=format(format=RemappingTemplate, args=[ srcDir+'/artifacts
   "IsDir": false,
   "HasADS": true,
   "SI_Lt_FN": false,
-  "uSecZeros": false,
+  "USecZeros": false,
   "Copied": false,
   "SIFlags": "2080 (ARCHIVE,COMPRESSED)",
   "Created0x10": "2018-09-24T07:55:29.7664719Z",
@@ -78,7 +78,7 @@ LET _ <= remap(config=format(format=RemappingTemplate, args=[ srcDir+'/artifacts
   "IsDir": false,
   "HasADS": true,
   "SI_Lt_FN": false,
-  "uSecZeros": false,
+  "USecZeros": false,
   "Copied": false,
   "SIFlags": "2080 (ARCHIVE,COMPRESSED)",
   "Created0x10": "2018-09-24T07:55:29.7664719Z",
diff --git a/docs/wix/velociraptor_amd64.xml b/docs/wix/velociraptor_amd64.xml
index 4ffe0909363..dfebffa7153 100644
--- a/docs/wix/velociraptor_amd64.xml
+++ b/docs/wix/velociraptor_amd64.xml
@@ -3,7 +3,7 @@
 <?define PackageDescription="Velociraptor Service Installer" ?>
 <?define Manufacturer="Velocidex" ?>
 <?define Name="Velociraptor" ?>
-<?define Version="0.72.3" ?>
+<?define Version="0.73.3" ?>
 <?define BinaryName="Velociraptor.exe" ?>
 
 <Wix xmlns="http://schemas.microsoft.com/wix/2006/wi"
diff --git a/docs/wix/velociraptor_x86.xml b/docs/wix/velociraptor_x86.xml
index 6a4d4554b41..234355e92f6 100755
--- a/docs/wix/velociraptor_x86.xml
+++ b/docs/wix/velociraptor_x86.xml
@@ -3,7 +3,7 @@
 <?define PackageDescription="Velociraptor Service Installer" ?>
 <?define Manufacturer="Velocidex" ?>
 <?define Name="Velociraptor" ?>
-<?define Version="0.72.3" ?>
+<?define Version="0.73.3" ?>
 <?define BinaryName="Velociraptor.exe" ?>
 
 <Wix xmlns="http://schemas.microsoft.com/wix/2006/wi"
@@ -39,7 +39,7 @@
           <Component Id='Install' Guid='9f3cfed0-b89d-43d4-8fcf-242824e84fd8'>
             <CreateFolder>
               <Permission User="[WIX_ACCOUNT_USERS]" GenericRead="no" Read="no"
-                          ChangePermission="yes"/>
+                          ChangePermission="no"/>
               <Permission User="[WIX_ACCOUNT_ADMINISTRATORS]" GenericAll="yes"
                           ChangePermission="yes"/>
               <Permission User="[WIX_ACCOUNT_LOCALSYSTEM]" GenericAll="yes"
@@ -50,7 +50,7 @@
             <Component Id="Tools" Guid="97dc953a-8a2f-494f-9585-56ae526d0b48">
               <CreateFolder>
                 <Permission User="[WIX_ACCOUNT_USERS]" GenericRead="no" Read="no"
-                            ChangePermission="yes"/>
+                            ChangePermission="no"/>
                 <Permission User="[WIX_ACCOUNT_ADMINISTRATORS]" GenericAll="yes"
                             ChangePermission="yes"/>
                 <Permission User="[WIX_ACCOUNT_LOCALSYSTEM]" GenericAll="yes"
diff --git a/go.mod b/go.mod
index eab39a031c8..98d844dddca 100644
--- a/go.mod
+++ b/go.mod
@@ -77,7 +77,7 @@ require (
 	golang.org/x/mod v0.21.0
 	golang.org/x/net v0.30.0
 	golang.org/x/sys v0.26.0
-	golang.org/x/text v0.19.0
+	golang.org/x/text v0.20.0
 	golang.org/x/time v0.5.0
 	google.golang.org/api v0.169.0
 	google.golang.org/genproto v0.0.0-20240213162025-012b6fc9bca9 // indirect
@@ -90,12 +90,12 @@ require (
 	howett.net/plist v1.0.0
 	www.velocidex.com/golang/evtx v0.2.1-0.20240730174545-3e4ff3d96433
 	www.velocidex.com/golang/go-ese v0.2.1-0.20240919031214-2aa005106db2
-	www.velocidex.com/golang/go-ntfs v0.2.1-0.20240818145200-04736de821dc
+	www.velocidex.com/golang/go-ntfs v0.2.1-0.20241110090212-80bdce4262fa
 	www.velocidex.com/golang/go-pe v0.1.1-0.20230228112150-ef2eadf34bc3
 	www.velocidex.com/golang/go-prefetch v0.0.0-20240910051453-2385582c1c22
 	www.velocidex.com/golang/oleparse v0.0.0-20230217092320-383a0121aafe
 	www.velocidex.com/golang/regparser v0.0.0-20240404115756-2169ac0e3c09
-	www.velocidex.com/golang/vfilter v0.0.0-20241009150353-76c3a28b1767
+	www.velocidex.com/golang/vfilter v0.0.0-20241110073117-207766c3922f
 )
 
 require (
@@ -115,7 +115,7 @@ require (
 	github.com/Velocidex/grok v0.0.1
 	github.com/Velocidex/ordereddict v0.0.0-20230909174157-2aa49cc5d11d
 	github.com/Velocidex/sigma-go v0.0.0-20241025122940-1b771d3d57a9
-	github.com/Velocidex/tracee_velociraptor v0.0.0-20241108032058-fada576fc41e
+	github.com/Velocidex/tracee_velociraptor v0.0.0-20241110080019-ef8be33cb3b1
 	github.com/VirusTotal/gyp v0.9.0
 	github.com/alecthomas/kingpin/v2 v2.4.0
 	github.com/alitto/pond v1.8.3
@@ -169,7 +169,6 @@ require (
 	github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 // indirect
 	github.com/alecthomas/units v0.0.0-20240927000941-0f3dac36c52b // indirect
 	github.com/andybalholm/cascadia v1.3.2 // indirect
-	github.com/aquasecurity/tracee/types v0.0.0-20241031161530-c8032d24da01 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.1 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.15.2 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.2 // indirect
@@ -202,6 +201,7 @@ require (
 	github.com/golang/gddo v0.0.0-20210115222349-20d68f94ee1f // indirect
 	github.com/golang/glog v1.2.2 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
+	github.com/google/gopacket v1.1.19 // indirect
 	github.com/google/s2a-go v0.1.7 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
 	github.com/googleapis/gax-go/v2 v2.12.2 // indirect
@@ -210,6 +210,7 @@ require (
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/golang-lru v1.0.2 // indirect
+	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/hillu/go-yara/v4 v4.3.2 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
@@ -248,7 +249,7 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
 	golang.org/x/exp v0.0.0-20241009180824-f66d83c29e7c // indirect
-	golang.org/x/sync v0.8.0 // indirect
+	golang.org/x/sync v0.9.0 // indirect
 	golang.org/x/term v0.25.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20241015192408-796eee8c2d53 // indirect
 	kernel.org/pub/linux/libs/security/libcap/cap v1.2.71 // indirect
diff --git a/go.sum b/go.sum
index 69500edb5be..70720dd9fba 100644
--- a/go.sum
+++ b/go.sum
@@ -96,8 +96,8 @@ github.com/Velocidex/sflags v0.3.1-0.20231011011525-620ab7ca8617 h1:pxAOaYTYwbWh
 github.com/Velocidex/sflags v0.3.1-0.20231011011525-620ab7ca8617/go.mod h1:TTYBEgQFkjJvyBOC2s7G1+mNPZ3IHuqLZmVFRzyPfq4=
 github.com/Velocidex/sigma-go v0.0.0-20241025122940-1b771d3d57a9 h1:YavusWZ+svpybfVg8cKk9MuSyeI479a0EGJ07VGpSm8=
 github.com/Velocidex/sigma-go v0.0.0-20241025122940-1b771d3d57a9/go.mod h1:ukLFs2t1+ud7MC4oN+zImhtTRP/eQHaDL3TwLs58uUA=
-github.com/Velocidex/tracee_velociraptor v0.0.0-20241108032058-fada576fc41e h1:nWbR32hOfyqIZM66PFdvkUAZ6dXe+fdmgWrt6IKHkrg=
-github.com/Velocidex/tracee_velociraptor v0.0.0-20241108032058-fada576fc41e/go.mod h1:Fw9Js/GV3VLc78CaAPxnfdoZP3nVQP4etqix+2Ef5gs=
+github.com/Velocidex/tracee_velociraptor v0.0.0-20241110080019-ef8be33cb3b1 h1:rg203zokfuaazvk8+xt5nSCJ410cVCOJ9sbar5krw10=
+github.com/Velocidex/tracee_velociraptor v0.0.0-20241110080019-ef8be33cb3b1/go.mod h1:DKcFdJ5IsrS+Dvl0mOGfsA2gTiIcxN5FEL599m3Qois=
 github.com/Velocidex/ttlcache/v2 v2.9.1-0.20240517145123-a3f45e86e130 h1:+QujZ0D7KSy3WJVchkOhMkvAUab6/CIisO5LCoN48q4=
 github.com/Velocidex/ttlcache/v2 v2.9.1-0.20240517145123-a3f45e86e130/go.mod h1:3/pI9BBAF7gydBWvMVtV7W1qRwshEG9lBwed/d8xfFg=
 github.com/Velocidex/yaml/v2 v2.2.8 h1:GUrSy4SBJ6RjGt43k6MeBKtw2z/27gh4A3hfFmFY3No=
@@ -146,8 +146,6 @@ github.com/andybalholm/cascadia v1.2.0/go.mod h1:YCyR8vOZT9aZ1CHEd8ap0gMVm2aFgxB
 github.com/andybalholm/cascadia v1.3.1/go.mod h1:R4bJ1UQfqADjvDa4P6HZHLh/3OxWWEqc0Sk8XGwHqvA=
 github.com/andybalholm/cascadia v1.3.2 h1:3Xi6Dw5lHF15JtdcmAHD3i1+T8plmv7BQ/nsViSLyss=
 github.com/andybalholm/cascadia v1.3.2/go.mod h1:7gtRlve5FxPPgIgX36uWBX58OdBsSS6lUvCFb+h7KvU=
-github.com/aquasecurity/tracee/types v0.0.0-20241031161530-c8032d24da01 h1:0B38MUH1H5P0+brcW41cLS7nAM5DBtJ5w1cfakyDv5U=
-github.com/aquasecurity/tracee/types v0.0.0-20241031161530-c8032d24da01/go.mod h1:Jwh9OOuiMHXDoGQY12N9ls5YB+j1FlRcXvFMvh1CmIU=
 github.com/araddon/dateparse v0.0.0-20210429162001-6b43995a97de h1:FxWPpzIjnTlhPwqqXc4/vE0f7GvRjuAsbW+HOIe8KnA=
 github.com/araddon/dateparse v0.0.0-20210429162001-6b43995a97de/go.mod h1:DCaWoUhZrYW9p1lxo/cm8EmUOOzAPSEZNGF2DK1dJgw=
 github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
@@ -331,6 +329,8 @@ github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF8=
+github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo=
 github.com/google/martian/v3 v3.3.2 h1:IqNFLAmvJOgVlpdEBiQbDc2EwKW77amAycfTuWKdfvw=
 github.com/google/martian/v3 v3.3.2/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk=
 github.com/google/rpmpack v0.5.0 h1:L16KZ3QvkFGpYhmp23iQip+mx1X39foEsqszjMNBm8A=
@@ -377,6 +377,8 @@ github.com/hashicorp/go-retryablehttp v0.7.7 h1:C8hUCYzor8PIfXHa4UrZkU4VvK8o9ISH
 github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFOxfA7DoAO6xtkuQnHTk=
 github.com/hashicorp/golang-lru v1.0.2 h1:dV3g9Z/unq5DpblPpw+Oqcv4dU/1omnb4Ok8iPY6p1c=
 github.com/hashicorp/golang-lru v1.0.2/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hashicorp/hcl v0.0.0-20170914154624-68e816d1c783/go.mod h1:oZtUIOe8dh44I2q6ScRibXws4Ajl+d+nod3AaR9vL5w=
 github.com/hillu/go-archive-zip-crypto v0.0.0-20200712202847-bd5cf365dd44 h1:seZZ+imS3iv6i0op0cqgt9K6BETRkXwUV9e8inrF+ws=
 github.com/hillu/go-archive-zip-crypto v0.0.0-20200712202847-bd5cf365dd44/go.mod h1:xUc/S/HgVuP6lhDvD0Wqtu/Npwx93VSXzbdyEDbqBb8=
@@ -690,6 +692,7 @@ golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTk
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/lint v0.0.0-20201208152925-83fdc39ff7b5/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/lint v0.0.0-20210508222113-6edffad5e616/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
@@ -743,8 +746,8 @@ golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
-golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.9.0 h1:fEo0HyrW1GIgZdpbhCRO0PkJajUS5H9IFUztCgEo2jQ=
+golang.org/x/sync v0.9.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -800,8 +803,8 @@ golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.19.0 h1:kTxAhCbGbxhK0IwgSKiMO5awPoDQ0RpfiVYBfK860YM=
-golang.org/x/text v0.19.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
+golang.org/x/text v0.20.0 h1:gK/Kv2otX8gz+wn7Rmb3vT96ZwuoxnQlY+HlJVj7Qug=
+golang.org/x/text v0.20.0/go.mod h1:D4IsuqiFMhST5bX19pQ9ikHC2GsaKyk/oF+pn3ducp4=
 golang.org/x/time v0.0.0-20170424234030-8be79e1e0910/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
 golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
@@ -919,8 +922,8 @@ www.velocidex.com/golang/evtx v0.2.1-0.20240730174545-3e4ff3d96433 h1:qrRlDit2WJ
 www.velocidex.com/golang/evtx v0.2.1-0.20240730174545-3e4ff3d96433/go.mod h1:z0QWgpVDct1l+cHNq64vrSWdFuY6/BgrW2f/Qrc6oK4=
 www.velocidex.com/golang/go-ese v0.2.1-0.20240919031214-2aa005106db2 h1:f7nj4NsyeMSrwiFd9XO/VfsZYt6o6FH1KJmmqlBZDgM=
 www.velocidex.com/golang/go-ese v0.2.1-0.20240919031214-2aa005106db2/go.mod h1:YKxCStqE15c6F/P81oCG0Y5oelDBah2hCdO6P+VPUIQ=
-www.velocidex.com/golang/go-ntfs v0.2.1-0.20240818145200-04736de821dc h1:eeL+RUEGr6/lYL8hJEbvugrF88I6W4pBaVtFa1falj4=
-www.velocidex.com/golang/go-ntfs v0.2.1-0.20240818145200-04736de821dc/go.mod h1:itvbHQcnLdTVIDY6fI3lR0zeBwXwBYBdUFtswE0x1vc=
+www.velocidex.com/golang/go-ntfs v0.2.1-0.20241110090212-80bdce4262fa h1:mVb1otJoAbwPaawm4ZPaKvgz0s7nQeH6jchXVhMZDpk=
+www.velocidex.com/golang/go-ntfs v0.2.1-0.20241110090212-80bdce4262fa/go.mod h1:itvbHQcnLdTVIDY6fI3lR0zeBwXwBYBdUFtswE0x1vc=
 www.velocidex.com/golang/go-pe v0.1.1-0.20230228112150-ef2eadf34bc3 h1:W394TEIFuHFxHY8mzTJPHI5v+M+NLKEHmHn7KY/VpEM=
 www.velocidex.com/golang/go-pe v0.1.1-0.20230228112150-ef2eadf34bc3/go.mod h1:agYwYzeeytVtdwkRrvxZAjgIA8SCeM/Tg7Ym2/jBwmA=
 www.velocidex.com/golang/go-prefetch v0.0.0-20240910051453-2385582c1c22 h1:Re+YlRCwkHESCIopk0WNLKXMnlnhALvoT4RiunT2qJE=
@@ -929,7 +932,7 @@ www.velocidex.com/golang/oleparse v0.0.0-20230217092320-383a0121aafe h1:o9jQWSwK
 www.velocidex.com/golang/oleparse v0.0.0-20230217092320-383a0121aafe/go.mod h1:R7IisRzDO7q5LVRJsCQf1xA50LrIavsPWzAjVE4THyY=
 www.velocidex.com/golang/regparser v0.0.0-20240404115756-2169ac0e3c09 h1:G1RWYBXP2lSzxKcrAU1YhiUlBetZ7hGIzIiWuuazvfo=
 www.velocidex.com/golang/regparser v0.0.0-20240404115756-2169ac0e3c09/go.mod h1:pxSECT5mWM3goJ4sxB4HCJNKnKqiAlpyT8XnvBwkLGU=
-www.velocidex.com/golang/vfilter v0.0.0-20241009150353-76c3a28b1767 h1:XUBc9OV6JZuLjIuGSyRS5sZmkWWdfav8SazJBy3MNeI=
-www.velocidex.com/golang/vfilter v0.0.0-20241009150353-76c3a28b1767/go.mod h1:P50KPQr2LpWVAu7ilGH8CBLBASGtOJ2971yA9YhR8rY=
+www.velocidex.com/golang/vfilter v0.0.0-20241110073117-207766c3922f h1:SmMCRRbHKEKiQlkOG70XilldpqFtwCkvT1fM/ZMiKTs=
+www.velocidex.com/golang/vfilter v0.0.0-20241110073117-207766c3922f/go.mod h1:P50KPQr2LpWVAu7ilGH8CBLBASGtOJ2971yA9YhR8rY=
 www.velocidex.com/golang/vtypes v0.0.0-20240123105603-069d4a7f435c h1:rL/It+Ig+mvIhmy9vl5gg5b6CX2J12x0v2SXIT2RoWE=
 www.velocidex.com/golang/vtypes v0.0.0-20240123105603-069d4a7f435c/go.mod h1:tjaJNlBWbvH4cEMrEu678CFR2hrtcdyPINIpRxrOh4U=
diff --git a/services/notebook/initial.go b/services/notebook/initial.go
index 91c98e6bf4b..4d40d6626d3 100644
--- a/services/notebook/initial.go
+++ b/services/notebook/initial.go
@@ -372,7 +372,7 @@ From {{ Scope "StartTime" }} to {{ Scope "EndTime" }}
 SELECT timestamp(epoch=_ts) AS ServerTime, *
  FROM source(start_time=StartTime, end_time=EndTime)
 LIMIT 50
-`, artifact_name, start_time, end_time),
+`, start_time, end_time, artifact_name),
 		})
 	}
 
diff --git a/vql/parsers/ntfs_protocols.go b/vql/parsers/ntfs_protocols.go
index 818b971d5cf..a1594289cf5 100644
--- a/vql/parsers/ntfs_protocols.go
+++ b/vql/parsers/ntfs_protocols.go
@@ -87,7 +87,7 @@ func (self _MFTHighlightAssociative) GetMembers(
 		"IsDir",
 		"HasADS",
 		"SI_Lt_FN",
-		"uSecZeros",
+		"USecZeros",
 		"Copied",
 		"SIFlags",
 		"Created0x10",