but it would be damn sexy if I could just replace fluentd and use the osquery to firehost plugin (btw, ty for that @jacknagz )