I should have specified this is in osquery/events/...
# general
b
I should have specified this is in osquery/events/linux/process_events.h and siblings