@SecOpsFTW I'd say using Osqueryd with some backend indexing/search is more effective for IR IMHO. Forensic data integrity and availability is maintained that way.