zwass
osquery> select 1 as missing where (select count(*) from file where path = '/bin/bash') = 0;
osquery> select 1 as missing where (select count(*) from file where path = '/bin/foo') = 0;
+---------+
| missing |
+---------+
| 1 |
+---------+