@allister check out my comments,

/var/osquery

is the "home" we've been using on OS X should be easy to stick with that