osquery is very good at the first part, but stays out of the second