Looks like osquery could pull events from macOS's ...
# general
c
Looks like osquery could pull events from macOS's OpenBSM, just like it pulls from Linux's auditd ^_^