https://github.com/osquery/osquery/pull/7712 - @Stefano Bonicatti do you think you could take a look at this as well? It's adapted from your idea.