I would still like to finish this PR https://github.com/facebook/osquery/pull/4982, what should I do for that? Is

master

branch completely deprecated and I need to rebase everything to

experimental

?

Yeah, I think master is totally deprecated. I’m not sure if rebasing is enough to attention for review, but it is probably a needed step. (I’m not speaking to the technical or product side of the PR)

Thanks! Unfortunately I cannot ship this table as extension as I need to read audit socket and process the corresponding data. Moreover apparmor shares the same event code as selinux and I need to tell one type of events from another. Sure I'll do all the steps to move my work to

experimental

branch.

Is this the kind of thing that fits as a column on the existing events table, vs a new table?

it's a new table