It might be possible if it's generating multiple events to corrolate. It's also worth investigating if there are any flags that can be added in the audit_control file