I’ve opened a support ticket with AV - they recommend osquery and provide config info - I have to assume they have heard this whine before too