the great thing about osquery was that it is a static binary easily to deploy, with ebpf support it is not really true (also if it is just one package)