But anyhow. I’m not really sure about your question. It seems to be about whether osquery could be a part of some larger ecosystem of agent based tools.

Which spans both C level market analysis, and potentially deep osquery knowledge.

My sense here is that: 1. osquery is a good agent, for things it’s good at 2. Many things osquery will not be good at. For example, clockwork likely requires some keep kernel hooks, and very tight latency requirements 3. Many companies will eschew using an OSS or third party agent, thinking that they need to own the agent themselves. This is akin to build vs buy, or NIH, but also different 4. There might be a market place / ecosystem for some kind of common agent and plugins. Could be interesting to imagine.

We do, somewhat, see osquery in a lot of random commercial EDR software. But there’s no real ecosystem there, since there is little incentive for the EDR vendors to play nice

yes, and, it's just something that maybe has to be explained better in the wiki, since a lot of vendors want osquery-as-a-library

A little bit, it’s akin to writing apache cgi scripts. Once you understand, it’s easy. But understanding takes awhile.