wazuh has an active response function like host-deny.sh, disable-account.sh, etc. They all accept arguments as <user> <action> <IP> I tried to re-use the same with osquery extensions with proper validation. It is working like a charm on Linux. https://github.com/sttor/osquery-wazuh-response

select * from active_response where rule="host-deny.sh" and action="add" and ip="24.56.78.98"';