process events only works if auditd is running and you have osquery #general

process_events only works if auditd is running and...

Hugh (Zercurity)

07/25/2019, 6:36 PM

process_events only works if auditd is running and you have the correct osqueryd flags set