at least we can while using the osquery audit stuff. we weren't having any luck getting the same sort of behavior from go-audit. that may be because of lack of programming skill on the report-writers side. I honestly didn't look into it close