@b0l you can't really use chef like that. Chef is for configuring and deploying osquery (if that's your tool of choice), but it doesn't function as a TLS endpoint the way you're thinking. In order to use on demand queries, you must have a TLS server of some sort for osquery to communicate with. You might be able to rig up some super janky way of shelling out to osquery on a box with chef and targeting hosts using chef, but that would be a pretty terrible idea imo