It would be fairly straight forward to add a `selinux_events`: https://github.com/facebook/osquery/blob/master/osquery/events/linux/audit.cpp#L628 just filter those event IDs into a table, hopefully there's some uniformity in the fields such that it could be filtered in a small set of columns