@robert.davis i think of it as “CB for process/network execution events, osquery for IOC/persistence mechanism identification/hunting”