Hi, I was thinking if we can reconsider osquery approach with the linux audits, I think if we can rely on audispd, it will be helpful, so we will have the ability to run multiple agents, or utilize other things from linux native audits, eg: if we want to detect strace to SSHD process, we need the linux audits at this stage as we dont have any tables for it, but we can't use the linux audits if we have osquery installed 😞 also was thinking if we can combine / merge audisp-json project with osquery audisp-json is an open source project since several years, developed by folks from mozilla and redhat, its a very stable project with a very efficient performance to get the basic logs, file logs tt will take the logs from the linux audit, correlating them into a single json event, eg: linux audits produces more than 5 events when a file will be modified, with this project, all of them will be correlated and rewritten in a single enriched json event. I tried the osquery table process_file_events, and comparing both solutions, the audisp-json is really awesome from the performance and reliability points.