Franklin Pezzuti Dyer
07/27/2023, 1:34 AMsocket_events
table.
I’m running osqueryi on MacOS with admin privileges and the following command-line options:
--audit_allow_config=true
--audit_allow_sockets=true
--disable_audit=false
--events_expiry=100
--events_max=50000
--logger_plugin=filesystem
--disable_events=false
When I select distinct path
from socket_events
, I see a handful of processes (Spotify, Spotify Helper, Slack Helper, Mail, give or take one or two others) undergoing socket events. But in the Activity Monitor of my Mac, I’m seeing several other apps (most notable Safari) with plenty of network activity. Can you think of any reason why these processes’ socket activity wouldn’t appear in the socket_events
table?Stefano Bonicatti
07/27/2023, 10:55 AMAUE_CONNECT
and AUE_BIND
events, so only on new connections or servers preparing to listen on a port.Stefano Bonicatti
07/27/2023, 10:57 AMFranklin Pezzuti Dyer
07/27/2023, 5:37 PM