My coworker @zwass wrote a blog post a while back that dives into osquery. IMO it's a good place to start, and it only gets into using the server as an option at the very end. https://osquery.io/blog/monitoring-macos-hosts-with-osquery