@kyle did you guys look into enabling openbsm auditing with osquery at all? not sure what the current state of affairs there is: https://github.com/facebook/osquery/blob/master/osquery/events/darwin/openbsm.cpp