technically there’s the audisp “plugin” for audit which multiplexes the events, but osquery is not using that