ha, we’re still working out some of the kinks of performance testing. One of our prod engineers is doing a lot of neat pre-filtering stuff with audit rules to lower the number of audit messages that osquery has to go through. We’ll get there one day 🙂