DFIR: From alert to root cause using Osquery without leaving Elastic Security