ideally we could get some more transparency around the data and the api and add more robust EFI analytics to osquery core… but if that’s not possible given resources at Duo, then i think an extension is the only way to bundle this capability as is imo.