@AB our configs only use process_events for linux. You should check out this section of the docs: https://osquery.readthedocs.io/en/stable/deployment/process-auditing/#macos-process-auditing