Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

I follow this article <https://blog.trailofbits.com/2020/03/16/real-time-file-monitoring-on-windows-with-osquery/>

And I make these file paths in my config:

```"file_paths": {
    "downloads": [
        "C:\\Windows\\System32\\winevt\\EventLogs",
        "C:\\Windows\\System32\\winevt\\EventLogs\\*",
        "C:\\Windows\\System32\\winevt\\Logs",
        "C:\\Windows\\System32\\winevt\\Logs\\*"]
  },```