i really like this blog article that @zwass wrote, it’s a good introduction to the basic mechanics of configuring and running osquery: https://blog.kolide.com/monitoring-macos-hosts-with-osquery-ba5dcc83122d