I have configured a pack with my directories to monitor: "file_paths": { "homes": [ "/root/%%", "/home/%/%%" ], "etc": [ "/etc/%%" ], "tmp": [ "/tmp/%%" "/var/tmp/%%" ], "binaries": [ "/bin/%%" "/sbin/%%" "/usr/sbin/%%" "/usr/bin/%%" "/usr/local/bin/%%" "/usr/local/sbin/%%" ], "libraries": [ "/lib/%%" "/usr/lib/%%" "/usr/local/lib/%%" "/lib64/%%" "/usr/lib64/%%" "/var/lib/%%" ], "kernel_params": [ "/proc/cmdline" ], "bootloader": [ "/boot/%%" ], "mount": [ "/mnt/%%" ], "lost+found": [ "/lost+found/%%" "/var/lost+found/%%" "/home/lost+found/%%" ] }, "exclude_paths": { "dev": [ "/dev/pts/%%" "/dev/shm/%%" ], "home/local": [ "/home/local/%%" ], "bash_history": [ "/home/%/.bash_history" ] }