anyway, the reason I stopped by, I was reading schema and came across https://osquery.io/schema/3.2.6#alf_exceptions