Implementing this an extension would provide many benefits, and allow everyone to use it without patching osquery 🙂