@alessandrogario @Mike Myers how are the ToB write extensions created? I'm guessing they don't use thrift? The PR to osquery itself is still not merged