What we've looked into doing is, as I mentioned above, having an osquery extension for whatever response capabilities you want