yeah, thats a good idea. I like the idea of osquery on windows but I have not messed too much with it yet