And osquery is too specialised to get me everything (say, sshd config), and shoehorning yara to do that seems like a horrible abuse 😛