My .02 on the question of using osqueryi during IR on systems.. I have written a python script to be dropped on a system and executed during a potential IR scenario which does execute a number of osqueryi commands to collect a variety of system data (the script does a number of other things as well, collecting raw files for example). While I agree not entirely the best option, if I've got a system that has no other security tooling on it and my options are collect manually, utilize system binaries, or use osqueryi, I'd much rather drop a python script and osquery binary on a system to consistently collect data, in an easily parsable format (json) as opposed to just using system level binaries to collect that data and have to deal with all the issues that could present.