@backherozzo doesn’t ATA do that all by itself? I’m just not sure what osquery brings to the picture as an addition or complement to ATA