Good morning everyone, I was wondering if it was possible to execute a query to the equivalent of "log show --style syslog --predicate 'process == "su"' --last 1h" on macOS. I'm specifically looking for a query that would provide me with information on failed su or sudo attempts. I understand there's process monitoring and fim capabilities with osquery and I've attempted some of the flags here: https://github.com/facebook/osquery/issues/3166 but don't see anything populated in the *_events tables.