when I wrote this, I was looking to take action, so I did not look much into the osquery route