@jdive IIRC we talked about being able to load lookup tables as sqlite tables in osquery to do this kind of intel lookups as subselects. are you familiar with that?