https://github.com/osquery/osquery logo
#macos
Title
v

vaar

12/19/2018, 3:50 PM
does socket_events work without an external kext?
p

packetzero

12/19/2018, 4:17 PM
v

vaar

12/19/2018, 4:20 PM
yes, it seems so
is there a plan for network event support on osx?
p

packetzero

12/19/2018, 4:26 PM
I don't know. Best to ask the facebook team, perhaps in #officehours
l

leadZERO

12/19/2018, 5:19 PM
Does osquery have any kexts currently?
I thought it was non-kernel only
p

packetzero

12/19/2018, 5:28 PM
If you are a coder, vaar, you can implement socket events on MacOS with something like this : https://github.com/packetzero/libntstat. TCP only, probably needs an update for Mojave.
2 Views