I'm not good yet with audit_control in MacOS but maybe this could help https://www.freebsd.org/doc/handbook/audit-config.html#event-selection ?