One use case for osquery that we’re thinking of is to continuously report back to system admins the status of the security config settings we expect to be enabled. Eg we want Windows Firewall enabled on all workstations - we’ll give the requirements to system admins and let them decide how/when to do it, and publish a graph for them to track their own progress. The chart also then becomes part of an ongoing “security dashboard” for them and their management. (We’ll set thresholds, alarms etc). This decouples us (InfoSec team) from their processes. That’s a super simplistic high-level overview....