@stephanie since you're specifically starting on ubuntu, you might find this useful: https://blog.securelyinsecure.com/post/deploying-osquery-pt1/, https://blog.securelyinsecure.com/post/deploying-osquery-pt2/