and maybe we extract stuff that's more applicable for sweeps into a separate category or just straight-up reference material. This reminds me of writing docs for my users for Santa - I tell them it's not AV, don't open it and expect to perform a scan. osquery can provide AV scan-like features with e.g. yara sigs, but maybe we're not painting the whole picture on how that's reactive versus behavioral/proactive