its possible its in osquery, definitely