Does it pull events from the audit subsystem?