looks like @seph touched on this a while ago and was thinking along the same lines but while some ideas were tossed around it didn't turn a corner? https://github.com/osquery/osquery/issues/6082 I'll open a new issue