Has anyone used osquery to monitor file_events on MacOS when it is deployed through Elastic Agents / Osquery Manager?