To be fair, most EDRs I’ve seen (not to say I think osquery is anything like a conventional EDR) poll outbound HTTPS because otherwise they can’t traverse a NAT for clients