We did. that's actually one of the reasons for this feature request https://github.com/facebook/osquery/issues/2736