If you can manage to tame it, auditd will give you a much more comprehensive look at what has happened on your machines. osquery is more like polling (on a lon

If you can manage to tame it, auditd will give you a much more comprehensive look at what has happened on your machines. osquery is more like polling (on a long interval because it's heavyweight) but auditd is processing events from the kernel.