OSQuery was merely a strawman, I also mentioned the audit subsystem, but these are just implementation details. I can not easily, in a supported fashion, track

OSQuery was merely a strawman, I also mentioned the audit subsystem, but these are just implementation details. I can not easily, in a supported fashion, track things like process executions or file interactions in a Fargate container. Maybe OSQuery could run as a sidecar, maybe auditd is actually exposed to the container, I honestly don't know. The end result is that companies leveraging things like aws lambda or fargate are also likely giving up instrumentation that they would consider standard on EC2. I don't think this is really controversial to say. You can absolutely justify to me that instrumentation is not worth 3rd party patch management and a nice ACL system etc.