I bind a port to all interfaces doing

nc -l -p 9999

and the corresponding event in

socket_events

is this:

{
  "name": "socket_events",
  "hostIdentifier": "myhost",
  "calendarTime": "Mon Nov  5 15:49:30 2018 UTC",
  "unixTime": 1541432970,
  "epoch": 0,
  "counter": 0,
  "columns": {
    "action": "bind",
    "auid": "1035",
    "family": "2",
    "local_address": "",
    "local_port": "0",
    "path": "/usr/bin/ncat",
    "pid": "7102",
    "remote_address": "0.0.0.0",
    "remote_port": "9999",
    "success": "1",
    "time": "1541432970"
  },
  "action": "added"
}

shouldn't

local_address

be

0.0.0.0

and

local_port

9999

, rather than remote_ ?