Yeah, I'm looking at mixing in something like sysmon w/ a C2 element to osquery, so if you trigger on some kind of "streaming analytic" that is event based, you can quickly trigger a state snapshot w/ something like os query for the exact stuff you mentioned like state of apps, configs, hashes, etc