a neat feature (that i wish i had the c++ skillz to write) would be running osquery in a “profiling” mode that gave you benchmarks around how many process/socket events it was seeing per minute on a host