Understood - you want to apply the logic closest to the source. Unfortunately, the trade-off there would be a pretty massive change to osquery's arhictecture - osquery would have to get into the business of storing data, and then into the business of allowing you to reference historical data in some consistent manner, etc. In general, you want to avoid that type of complexity on the end-point.