I knew AlienVault typically includes osquery query packs with their write-ups also