@lankesh Have you looked into https://osquery.readthedocs.io/en/stable/deployment/extensions/ ? You can try to write logger plugin, which can forward query results to some network address or unix socket