I've worked on something similar except that we used a stream database. Today you might use RethinkDB or something similar. The osquery events seem to solve th

I've worked on something similar except that we used a stream database. Today you might use RethinkDB or something similar. The osquery events seem to solve these kind of monitoring/alerting problems. But I didn't find easily find their documentation.