has any of you seen usage of

endpoint security framework

or

eslogger

via osquery other than

file_events

?

There is also

es_process_events

table, will notify on process fork, exec and exit