Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hi guys :wave:
saw this ticket <https://github.com/facebook/osquery/issues/3740> i am wondering if this feature is still work-in-progress :meep_thinking:
i am not getting any `selinux_events` even tho flag `--audit_allow_selinux_events` (for context, other queries like `socket_events`, `process_events` work as expected.

i search in slack and found some discussions, such as <https://osquery.slack.com/archives/C0L70NC1W/p1540821403022900?thread_ts=1540819265.018600>

```Malformed syscall event. The saddr field in the AUDIT_SOCKADDR record could not be parsed: "00000000000000000000000000000000"```

ah this should be unrelated to selinux, probably tied to a socket_event