If anyone wants to play around with the bpf_process_events table, we have uploaded a package here: https://osquery.slack.com/archives/CADGD9ACF/p1582824848002300?thread_ts=1582823174.000500&cid=CADGD9ACF