That or perhaps just poll the network on demand. From what I've read, what I'm asking seems to require an abstraction above OSQuery itself but I was wondering if anyone else is doing this and if so, how?