@robert.davis I feel like it really depends on what you're looking for. osquery is a little better at answering questions like "Which of my hosts in my entire fleet have this scheduled task/plist/crontab job?", where as CB is much better at response and flight recording. In theory you'd be just fine with one or the other. We use both as both give us valuable information, and each is better at different things