Hi @theopolis 👋 I know it’s been a long time since you wrote this comment on Github, but have you done the “small experiment” you’ve mentioned? https://github.com/facebook/osquery/issues/2804#issuecomment-263482365