are syscalls not supported in osquery for OSX?

select * from osquery_events

Observe the existing publishers to determine if your use-case can be covered by osquery

ty!

You have to enable process auditing in BSM. See https://osquery.readthedocs.io/en/stable/deployment/process-auditing/#macos-process-auditing

ic!