Hi folks, I'm going to give a talk "eBPF and the future of osquery on Linux" for the osquery@scale conference. Any particular questions come to mind or topics you'd like me to touch on? You can grab tix for the event at https://www.osqueryatscale.com/.

CO-RE support is on the roadmap? what is the plan to get all process context infos like auditd does? (cwd, full process name (not just 32 bytes of 'comm'), all possible args, etc)

These are great questions. I'm going to have to go to @alessandrogario with some of these.