@clong - I'm looking at osquery more on the hunting side than as something that would actively monitor logs - not super thrilled with my EDR tool for interrogating assets in realtime