I don't see why it wouldnt work, since it looks like it is just stock osquery logging to the filesystem, which the Wazuh endpoint app then picks up