I ma reading this https://osquery.readthedocs.io/en/1.4.5/deployment/kernel-linux/ and was thinking what else can be added. Recently I found this tool https://gitlab.com/nowayout/prochunter that can be integrated with processes table