Folks have ideas of information available through the new macOS

EndpointSecurity

framework that would be useful to expose in osquery? See the list of event types in https://developer.apple.com/documentation/endpointsecurity/event_types?changes=latest_minor&language=objc.