there's an extension in the Trail of Bits repository https://github.com/trailofbits/osquery-extensions that reads from the new unified log