The Drata agent does exactly what you are talking about with a lightweight osquery based read-only agent. Literally just monitors some system settings like screen lock timeout, av-install, updates, etc. We collect that data to then be able to show your auditor you are meeting your controls.
Source: I am the Drata CISO