Add support for "or" queries against resource events
Add `certname` to output of event queries