osquery is the perfect companion for CB on endpoints IMO. CB is actually quite performant when turned properly and does an awesome job at indexing events and making them searchable with process trees and such. osquery fills in all the other blanks for enumerating persistence mechanisms, config changes, etc