I’m not sure if we can find a way to parse this; I didn’t want to slow down too much the audit framework in osquery