I wonder if you could use the prometheus table for this? https://osquery.readthedocs.io/en/stable/deployment/configuration/#configuration-components (see prometheus)

So in this case, osquery will be pulling like prometheus right ? I was looking for push, so that we dont miss events and process can send immediately

got it. this would be pull, yet.

Yeah thanks