We have an ongoing project and existing prototype that combines OSquery with the Bro network security monitor. This enables correlation of network and host state in the same framework.

More details here: https://www.bro.org//bro4pros2017/Haas_OSquery_Bro4Pros2017....