The

StreamAlert: A Serverless, Real-time Intrusion Detection Engine

talk we're giving utilizes Kinesis and can accept data from osquery + other agents