@ashvin to do something like that, you would need to be managing your osquery endpoints with an OSQuery TLS server of some form. There are quite a few options out there (zentral, doorman, kolide, to name a few). It would work by having the server tell a specific node to run what's called a distributed query (aka run only once). That query would be the information your trying to get from the endpoint