https://github.com/facebook/osquery/pull/4096 I think this will get us closer to being able to do that