I do agree, that it's a better option to always have osqeryd running in the background, or some other tooling to collect data, but that's not always going to be possible in all cases where IR is involved.