https://github.com/osquery/osquery logo
#general
Title
# general
b

Brandon Mesa

04/06/2023, 4:08 PM
has anyone else noticed that FIM (FSevents) on macOS does not work with hidden directories? e.g. .ssh. Is that by design? It looks like FIM with EndpointSecurity does track it
z

zwass

04/06/2023, 4:49 PM
IIRC there may have been an issue/PR about this recently?
k

Kiwito

04/06/2023, 9:27 PM
Hey Brandon, I don't know about issue (checked and couldn't find) if I am not mistaken, it is a known feature to exclude hidden directories 😞
24 Views