Updated anomaly detection using osquery (markdown)
Link to aggregation guide
Short writeup on using osquery differentials