@spookerlabs at my last company we were using osquery to validate our CIS benchmark(ish) compliance changes. I still have the queries along side each rules for a few different Linux operating systems (Ubuntu and CentOS). I'll dig it up and pass them along if you would want that :) warning was very alpha :D