Nice, yeah I think I might be looking into it if no one has done that already. Might be a good way to learn more about Osquery/kernel level apis if anything.