@Gray Cat You can write your logger-plugin to do that https://osquery.readthedocs.io/en/stable/deployment/logging/#logger-plugins Or If you are using syslog then you can define syslog rule to add whatever you want to append.