eventually these will move to @groob's osquery-condition (once I've started down the golang path)