I also have to say, if you have a established deployment process, writing a table as a plugin and distributing it takes no more time than patching osquery and distributing that. In both cases you’re building and deploying some binary.