when we start talking about event-driven things like FIM, osquery is doing things that are tricky to do by hand