osquery not giving connection 'close' event in socket_events
I have configured osquery to query table socket_events. When i use curl -k "
https://www.google.com" , i get the action:"connect" event. But once the curl command ends, the 'Close' event is not seen.
In osquery.conf have configured to query socket_events.
"socket_events": { "query": "SELECT * FROM socket_events;", "removed": false, "interval": 10 }
curl -k "
https://www.google.com"
Can see string:
{"name":"socket_events","hostIdentifier":"XXX","calendarTime":"Wed May 3 17
0318 2023...