@npratley that's a great question, unfortunately it's only capturing `user_events`: https://github.com/facebook/osquery/blob/master/osquery/events/linux/audit.cpp#L684 as defined by the event IDs in that range.