my implementation is in osquery itself though not an extension