(though not with osquery yet for the most part, most of our hosts use our old in-house osquery-alike tool)