you might fare better with implementing this using osquery-go