I love that idea @thor. It would be really cool to have an "osquery use-cases" blog/repo/whatever