@RT this is my fav article on getting up and running with osquery on macOS: https://blog.kolide.com/monitoring-macos-hosts-with-osquery-ba5dcc83122d