My read on what you’re asking, is whether anyone has hooked osquery to a reasonable SOAR setup. Either directly, or with some fleet manager as a middle layer