can osquery pull from the new subsystem