so I went for it with a hope that osquery could solve my logging issues, 3 days later elk stack set up, logs feeding in, I check out socket_events but it only seems to populate the first hop (the nat), is this a known issue ? I’m assuming this is partly to do with the fact its from kernel space as process_open_sockets seems to be ok .. does this mean I have to write my own event code that populates from application logs like process_open_sockets or is there something I’m missing.. ? Seems nuts that socket_events doesn’t do this ..