I've made a small blueprint here: https://github.com/osquery/osquery/issues/5975 Would like some feedback! I couldn't tag you @packetzero, but i would also like to hear your opinion 🙂