@andrew funny you should say that regarding CIS benchmark pack - we recently hardened all our machines to the standard and I wanted to monitor if anything was modified when running with osquery as we use it already for a lot in house. I am quite a way through the Ubuntu version (just started on CentOS) and will release it as soon as I am done. obviously some checks cannot be done but we achieved using other measures such as using templates for

/etc/ssh/sshd_config

and just watching the hash.