I was referring to the

file_paths

in the config, which is what tells the underlying event subsystem which filesystem location to "watch" for changes https://osquery.readthedocs.io/en/latest/deployment/file-integrity-monitoring/#example-fim-config