But I think it is not possible the more I read. There is a ticket asking for the same thing here: https://github.com/osquery/osquery/issues/3372