would be pretty slick for this usecase, but of course this would require you to ship intel to agents, as opposed to collecting all of the events and doing server-side analysis