at least for `osquery-monitoring`