Question: Can you setup osqueryd to alert on the use of

sudo

with the contents of the cmd it was used? Ideally a single query supported on both linux/mac