Respectfully disagree. It’s not sure if @nebi is asking about using osqueryi or doing something distributed — but events do work with osqueryi.