First question and first exploration of osquery. I have the client installed and I can use Fleet to query the agent, simple queries like SELECT * FROM processes; work like a champ. I now want to set it up so file edits are reported, so if a file is created or edited, something will appear in Fleet. With the default install, what directories does osquery report on? How is that changed? Should I be using a query like SELECT * FROM file_events; or something different? Any help appreciated.

#C01DXJL16D8 — osquery has no defaults for file watch

https://osquery.readthedocs.io/en/stable/deployment/file-integrity-monitoring/ and tagging a channel name like #C01DXJL16D8 isn't really a thing in slack. It just makes a link to the channel in the UI.