this might be something to look into when everyone gets back https://github.com/facebook/osquery/pull/4602