osquery-defense-kit/incident_response/es_process_events.sql

-- Dump a list of process execution events from EndpointSecurity
--
-- platform: darwin
SELECT * FROM es_process_events;