I've a basic question; does osquery rely on ebpf currently, or is that a setting that needs to be enabled first?

osquery can use ebpf but it's not enabled by default, moreover it's connected to its own set of tables, separate from audit; both are available.

so it only comes into play with process auditing, and things like event tables?

yes! 🙂, more info at: https://osquery.readthedocs.io/en/latest/deployment/process-auditing/#linux-process-and-socket-auditing-using-bpf

yup, that's where I was reading, just wanted to confirm I was comprehending correctly., thanks!