So in the end the person that was interested in this told me that they are already parsing the raw logs from auditd, so it did make sense to leave this untouched