so it doesn't look like it passes constraint on my version of 3.3.1 osquery with fixes for indexing. please try on yours.