Has anyone managed to get access to the TI ETW feed within windows as an OSquery plugin? I suppose this will require publication of a separate Microsoft signed driver to get to the PPL level but curious if there is any open source route not requiring Microsoft's signing