(which is my other issue, that I can’t configure osquery to stop using it’s generic kernel audit rules and instead read those from a file but, I was able to work around that)