Yeah I'm not sure it's possible to do this accurately without batch format, because I don't know if you could guarantee getting the adds/removes in the correct order from osquery otherwise.