Perhaps a bit on the basic side for folks in this Slack, but I just published an intro to osquery for macOS admins: https://blog.kolide.com/monitoring-macos-hosts-with-osquery-ba5dcc83122d