We have a threat hunting / EDR platform based on OSQuery. https://www.spellsecurity.com/spellhunt . We are also in the process of open sourcing our windows EDR plugin for OSQuery