@theopolis to be fair, it is just a PoC, I prefer to write it as extension for now, because I don't have so much experience with osquery core source code, yet.. 🙂