I don't know about production, but I use it on my MacOS laptop to list all listening sockets with the associated command line. Should I be concerned that this sort of thing has correctness bugs? (Can anyone give a competing non-osquery implementation on MacOS?)

  sockets() {
    (osqueryi --list --separator ',' | column -t -s ',') <<EOF
  SELECT s.local_port, p.cmdline
  FROM process_open_sockets AS s
  INNER JOIN processes AS p
  ON s.pid = p.pid
  WHERE s.state = 'LISTEN'
  ORDER BY p.cmdline;
  EOF
  }