can I use osquery to measure how long a program took to execute?

Maybe, by catching all the process events (starts and exits) and then computing the program execution time (as wall clock time)