the new endpoint security-based table is es_process_events, but I don't know what's a hard requirement on arm-arch-based Macs