There's at least one open data quality issue for `process_open_sockets` on macOS[1]. It's a few years old however and, if you aren't seeing that casting error,

There's at least one open data quality issue for `process_open_sockets` on macOS[1]. It's a few years old however and, if you aren't seeing that casting error, you probably aren't hitting it. But that's a good example of the kind of debt that's been built up over time. (In terms of general purpose/flexible tooling, I'm not aware of a close replacement for osquery.) [1]: https://github.com/osquery/osquery/issues/6319 https://github.com/osquery/osquery/issues/6319