https://github.com/osquery/osquery logo
s

Stefano Bonicatti

07/20/2022, 1:29 PM
Yeah. Although admittedly you should be able to see a result sometime. I mean what I’m saying should only happen when the two events (process and socket) come one before the query has run and one after. This shouldn’t be always true