i could see perhaps having a cluster of worker nodes where malware was picked off from an object store and analyzed by some code that was executing as an osquery table/extension. extension is being programatically interacted with, etc