Hey how to get dns-lookup events in Linux osquery and match it with process table.. Anyone tried before?

I haven’t specifically tried it, but you could get some starting point by using the socket events and then looking for dns queries, UDP maybe.. practically all DNS should end up in UDP but some huge ones could fallback to TCP..