I was thinking about taking all the file paths for https://github.com/ForensicArtifacts/artifacts/blob/master/data/linux.yaml and making a query pack that checks the hashes. They could go into a FIM conf as well, but we don’t currently run the daemon just on demand with the osqueryi against a baseline. Has anyone already built such a pack? Or is it worth some sort of translator that takes the yaml from ForensicArtifacts and produces osquery conf format? They don’t seem to change to often and would need some clean up for files that are covered by osquery tables (ex deb packages).