https://github.com/osquery/osquery logo
s

Stefano Bonicatti

07/20/2022, 1:39 PM
no sure, but we are not doing any additional work when displaying audit events; we are not evaluating the socket fd to then get additional information about the scocket fd, which btw could be out of date, because it won’t be inline with the event