@rhuber well, if you follow https://github.com/facebook/osquery/blob/master/docs/wiki/deployment/process-auditing.md, you'll be able to query

process_events

at an interval and some auditd data will be streamed there