Hi Guys! I had question, does anyone know how ntfs_journal_events subscribes to paths. Does it use processconfiguration (shown below)? Would that mean if a class were to inherit from ntfseventsubscriber (class used in ntfs_journal_events [i know its a final class atm] ), would passing processconfiguration subscribe to the paths? ( From yara_events: // Collect the set of paths, we are mostly concerned with the categories.   // But the subscriber must duplicate the set of subscriptions such that the   // publisher's 'fire'-matching logic routes related events to our callback. )

void processConfiguration(const NTFSEventSubscriptionContextRef context,
                          const StringList& access_categories,
                          StringList& include_paths,
                          StringList& exclude_paths)