Hey there, I am using osquery on my mac to query p...
# macos
y
Hey there, I am using osquery on my mac to query process_events table. While my chrome browser is open I am receiving multiple records with chrome pid, which their 'path' is /dev/null (I notice now it happens with Slack as well). I know the use of /dev/null, but I don't understand why I get so many rows with it? Can I block these event types in the query? Can anyone specify what types of events are registered in the process_events table?