I have a question about FIM (file integration monitoring). Even if the file is created, it seems that CREATED and UDATED action events are created. And even if the generated file is modified, events of CREATED and UDATED actions are also created. So many events will take place. I'm monitoring only when the first file is created by the system or uploaded by ftp or other means. When you want to do this, how do you put it in the query of fim.conf? I put the selection statement in the fim.conf query as follows, but when the file is modified, an event will also occur. I have a question about FIM (file integration monitoring). Even if the file is created, it seems that CREATED and UDATED action events are created. And even if the generated file is modified, events of CREATED and UDATED actions are also created. So many events will take place. I want monitoring only the event that the first file is created by the system or uploaded by ftp or other means. I input bellow query in fim.conf but the modified event is generated at /var/log/osquery/osqueryd.results.log. select * from file_events where action="CREATED" GROUP BY target_path; but when I run select statement from osqueryi, only one result returned but the count(*) is not one event. When I want to detect first created file , how do you put it in the query of fim.conf? Is there a way to detect only the first file created? thanks any advice,