@KM as far as I know there is no reason why process events should work differently on Apple Silicon macs, since they're collected through the Endpoint Security API