I'm just making a point about having endpoint data come from osquery and other feeds come from an API and you combine them in a server like fleet or doorman instead of combining them on the endpoint