i noticed

/etc/security/audit_control

was reverted back to the default on my mac in the past week or so. i suspect this occurred when i updated from 10.15.4 to 10.15.5 (similar to how

/var/log/osquery/

gets blown away during incremental upgrades in 10.15). i was curious if this is expected behavior?

Yeah. Most (all?) of /etc/ gets wiped on upgrades

boo 😞