To use osquery as your syslog consumer: http://osquery.readthedocs.io/en/stable/deployment/syslog/ To enable process and socket events via configuration: http://osquery.readthedocs.io/en/stable/deployment/process-auditing/