For what it’s worth, a common model is to have osqueryd push logs into some kind of SIEM, and then build on top of that.