So I believe the current Wazuh implementation just ships the osquery logs to the Wazuh manager, and then you have the ability to generate Wazuh alerts from them.