Is anyone aware of a good article on the various osquery flags needed to do process and file monitoring on linux and mac? There are a few in play, and with the addition of the BPF tables I'd love to know best practices -- do we still need register for auditd, or do the BPF tables not yet cover things like

file_events

etc ?

BPF currently handles socket and process events. The osquery docs for file monitoring and process auditing are actually fairly beefy... I think that's why it's difficult to track down detailed tutorials

Right - so it reads to be like if you want to do file monitoring, you need to use the audit framework. However both audit and BPF support process auditing - is there a preference between the two for performance or other reasons ?