@Brian Rak lots of ways to go about it, but perhaps the simplest is https://www.osquery.io/schema/3.3.2#osquery_schedule