technically there’s the audisp “plugin” for audit ...
# general
s
technically there’s the audisp “plugin” for audit which multiplexes the events, but osquery is not using that