Wrt the comments to ^ it's probably not very effective to deploy osquery without aide / tripwire or similar...