@allister - it's a attempt to cover as much as possible w/ osquery. not all checks in that 300+ items have a working shell companion. I try to cover as much as possible with the greatest tool course 🙂