@zwass I think this could reasonable be either it’s own repo. or hang out somewhere in osquery. If you chose the latter https://github.com/osquery/osquery/pull/5855 might be interesting or unimportant.