No matter what you will need a mechanism to deploy osquery at some scale and manage the agent (flags, cert, secret, config etc, schedule queries, configure event tables, FIM config etc). Next, for the results of the queries, a few things to consider if you’re planning to write to local disk/log file: a) Depending on how many events, queries etc you’ve scheduled, it can generate a lot of volume and can result in significant I/O usage b) You will have to forward the logs reliably to a backend (e.g splunk) c) If you use snapshot mode and capture with high frequency, it will be prohibitively expense and if the frequency is low, you will miss events/data d) If you use differential mode, reconstructing timeline in splunk is a significant challenge (likely unsolved problem) that you need to consider, hence people may revert to snapshot and that mode is very expensive/inefficient.