speaking of all the recent mac app malware @allister just wrote up a nice blog post on osquery and santa and autopkg https://www.afp548.com/2017/05/08/hipster-software-management/