I've always felt that this is something best handled by osquery extensions. i think it's a totally legit thing to get osquery to do, but is maybe not something that we should be supporting in upstream.