@clong - We have our SIEM collecting a lot of logs, but to check certain items on the OS we would need something like osquery