(right now I get osquery to log to syslog, and get all my transport free, since we’re already bringing syslog into the siem)