I know this is typically recorded on

/var/log/auth.log

but I'm not sure how to get that information via osquery