Regarding performance framework, could you please elaborate? Are you asking about Ops performace measurement or is your question around how to keep osquery performant and deterministic under varying workloads and deployments? For the latter, i.e. osquery being performant, osquery can be configured to be very performant for all multiple security use cases by using osquery as a source of telemetry and place shifting your security detection pipeline and queries to a backed (e.g. splunk in your case). Additionally osquery has tooling for you analyze the cost of queries and it has built in mechanism to stop running resource intensive queries. For the former (ops performance), while osquery can collect the data for Ops, the scope of data at a high level can be bucketed into numeric and state related metrics for ops observability. For numeric metrics etc, there are more optimal solutions e.g. prometheus (which osquery integrates with via table) to scape osuqery metrics from prometheus agent. For state metrics e.g. config file, deployed packages, inventory etc, osquery is very valuable and it provides the data. The CIS benchmarks are something you can consider for operations conformity and osquery can definitely help in this. Similarly for security use cases osquery lends it self very well to ATT&CK. While I’m not particularly aware of performance frameworks for osquery, most of the performance frameworks are for numeric metrics - you may want to look at open census (opencensus.io) and open telemetry (opentelemetry.io).