I have read it, very nice and informative read! I am currently working on yara_events to work with ntfs_journal_events, however yara_events will not subscribe to the paths listed in osquery.conf. Trying write_paths.insert(file) or changing /using functions like processconfiguration wont work either. Currently trying to understand the whole process of how ntfs_journal_events is subscribing to paths etc. So does the genglobs expand the paths with wildcards to path-names pertaining to that path?