I don't think it can be done with osquery as of now, but perhaps someone will correct me on that 😉