@Matt Brown A couple of quick notes. (disclaimer: I work for Kolide, though have done several osquery things prior). It sounds like you’re blurring some things together. The way I think of it, there are several pieces to a system. There’s an agent on the machine. A way of getting configs/questions to that agent. A log pipeline. (And the log pipeline itself has several moving parts) To me, osquery is an agent. It’s a great cross platform way to ask a question. But, it doesn’t help you with either the config distribution or the log pipeline. osquery and splunk can work really well together. Though how to get from an endpoint osquery into splunk is very site specific.