My schdule in osquery.conf: "schedule": { "process_events":{ "query": "SELECT auid, cmdline, ctime, cwd, egid, euid, gid, parent, path, pid, time, uid FROM process_events WHERE path NOT IN ('/bin/sed', '/usr/bin/tr', '/bin/gawk', '/bin/date', '/bin/mktemp', '/usr/bin/dirname', '/usr/bin/head', '/usr/bin/jq', '/bin/cut', '/bin/uname', '/bin/basename') and cmdline NOT LIKE '%_key%' AND cmdline NOT LIKE '%secret%';", "interval": 10, "description": "Process events collected from the audit framework" }, "socket_events":{ "query": "SELECT action, auid, family, local_address, local_port, path, pid, remote_address, remote_port, success, time FROM socket_events WHERE path NOT IN ('/usr/bin/hostname') AND remote_address NOT IN ('127.0.0.1', '169.254.169.254', '', '0000000000000000000000000000:0001', '::1', '00000000000000000000ffff7f00:0001', 'unknown', '0.0.0.0', '0000000000000000000000000000:0000');", "interval": 10, "description": "Socket events collected from the audit framework" } }