sundsta
08/01/2019, 8:08 PMactive
column indicates on osquery_events
? It shows as 1
for process_events
on Linux hosts without process auditing enabledclippy
08/01/2019, 8:25 PM1 if the publisher or subscriber is active else 0
sundsta
08/01/2019, 8:29 PM