I liked my "OOB through osquery" approach because it validates /right now/, but it's a bit rube goldberg I think for something I'd want to use in prod