Hello all, I'm currently configuring osquery with Fleet. I'm trying to use both BPF events and the Audit subsystem together to get complete coverage. Here's a snippet of my current flags configuration:

command_line_flags:
  disable_audit: false
  enable_bpf_events: true
  disable_events=false
  enable_file_events: true

When I check the osquery_events table, I can see that the audit publisher is now active, but I'm not seeing file events being generated when files in the monitored paths are modified, whereas I could see the bpf_process_events and bpf_socket_events. My questions: 1. Can BPF events and Audit subsystem be used together effectively, or do they conflict? 2. Is there a preferred approach for comprehensive monitoring that includes both FIM and process/socket monitoring? 3. Are there specific configurations needed to ensure FIM works properly with these settings? 4. Should I be using a specific publisher for FIM (inotify vs audit vs BPF)? Any guidance would be greatly appreciated!