`/etc/security/audit_event` has a few socket event...
# macos
b
/etc/security/audit_event
has a few socket events