osquery-defense-kit/incident_response/es_process_events.sql

-- Dump a list of process execution events from EndpointSecurity
--
-- platform: darwin
SELECT
  *
FROM
  es_process_events;