Proposal (which I can raise on GitHub as a blueprint, but wanted to post here for quick discussion first), since we'll have

bpf_process_events

and

es_process_events

, should we rename the original to

audit_process_events

? The code should facilitate this "aliasing" without breaking people's existing queries. Essentially

process_events

will become a clone, of

audit_process_events

and will not show up in documentation/schema listing, but the virtual table will exist.

Makes sense to me

https://github.com/osquery/osquery/pull/6571#issuecomment-665922702 Alessandro told me this last time but maybe you're asking a slightly different question

Maybe we could come up with a small subset of columns that should be always present, and use those in the alias as some sort of interface

For most things we try to abstract the concept across operating systems. But there is too much nuance, configuration, and expectation setting with process eventing so it makes sense to have them technology specific. We can iterate though.