osquery.conf.d]# cat processaudit.conf 
{ 
  "schedule": {
     "socket_events": {
       "query": "SELECT * from socket_events;",
       "removed": false,
       "interval": 10
     },
     "process_events": {
       "query": "SELECT * from process_events;",
       "removed": false,
       "interval": 10
     },
     "user_events": {
      "query": "SELECT * from user_events;",
       "removed": false,
       "interval": 10
     } 
  } 
}