This is more of a personal opinion, but I would highly recommend investing in a logging infra before worrying about anything like pulling in data from osquery and such