Just put up an RFC: https://github.com/facebook/osquery/pull/4271 If you have suggestions or strong opinions please let me know!