Isn’t there an internal-to-osquery way to do that?