Default logging with no rules

Hi there, I started playing with the audit subsystem a few days ago, and noticed that even without any rules, there is a lot of logging going on. I understand that rules have to be fine tuned, and I was expecting having to do that, but I wasn't expecting the amount of logs on a busy system with no rules at all. I read in an old presentation (~2011) that these come from "trusted apps", and in fact any process with cap_audit_write (iirc) can log such events. The tip was that exclude/never list/action could be used to reduce this noise, is that still the case and recommended approach? Or is there a way to use audit with only the rules defined in /etc/audit/rules.d?