Thanks, @Hugh (Zercurity)! Do you know if the process_events table will work if auditd is running or does OSQuery need to bind to the same kernel interface as auditd for those events to work?