i don't think that osquery has an opinion on whether or not you do your analysis on hosts via complex queries or if you do it on the server via post-ingestion analysis