does socket_events work without an external kext?
# macosv
vaar
12/19/2018, 3:50 PMdoes socket_events work without an external kext?
p
packetzero
12/19/2018, 4:17 PMappears to be linux only? https://www.osquery.io/schema/3.3.0#socket_events
v
vaar
12/19/2018, 4:20 PMyes, it seems so
vaar
12/19/2018, 4:20 PMis there a plan for network event support on osx?
p
packetzero
12/19/2018, 4:26 PMI don't know. Best to ask the facebook team, perhaps in #officehours
l
leadZERO
12/19/2018, 5:19 PMDoes osquery have any kexts currently?
leadZERO
12/19/2018, 5:20 PMI thought it was non-kernel only
p
packetzero
12/19/2018, 5:28 PMIf you are a coder, vaar, you can implement socket events on MacOS with something like this : https://github.com/packetzero/libntstat. TCP only, probably needs an update for Mojave.
2 Views