@thor pointed me at: https://www.digitalocean.com/community/tutorials/how-to-monitor-your-system-security-with-osquery-on-ubuntu-16-04 it's a very complete guide and something we've been missing