Let's say I have an endpoint running osquery. If antivirus on that endpoint fires off an event and sends it to a security orchestration tool, how would that tool call back to the endpoint to investigate that event?