@alessandrogario is the osquery audit master, maybe he has some ideas?