If you're doing this it's also probably going to be crucial to use https://osquery.readthedocs.io/en/stable/deployment/logging/#batch-format