Have you looked into the osquery watchdog?