Yeah, I was able to work around some issues we saw by modifying the audit rules outside of osquery, i.e.: