was wondering about that. auditd output is a bear. I would figure the elegance of osquery output is substantially better than any auditd like capability