From the web results many ppl use osquery for some kind ok security monitoring tool. I think monitoring system call could be a good enhancement