Hello, when looking at how osquery collect user commandline data, it pulls from the history log file. Can someone confirm that is the case and is there any way to collect commands from the kernel audit stream? If anyone can help with this that would be great. Thanks.