@thor for one I don't think osquery is the tool I need, as for example from skimming through documentation I didn't see an option to check sshd config for specific configuration lines. Chef maybe could, or more specifically InSpec, but from my reading to get proper reporting out of it we'd need to get the enterprise option, and 137USD per machine is a bit much if you count them in thousands and want to only check for presence of baseline config. So I'm looking for options.