Osquery uses the audit socket, yes
# general
c
Osquery uses the audit socket, yes