I fashioned a table of use cases / circumstances and which endpoint security features would help address them: https://github.com/osquery/osquery/pull/8565#issuecomment-2840822102