@kizyle502 yeah, right now it’s primarily useful for monitoring files that are expected to be static (e.g. /etc/passwd, /etc/hosts, etc..) but lacks any context about what changed or the process responsible for the changes. There is also an audit-based FIM option in osquery 3.x which will get you the process context, but it comes with quite a bit of CPU overhead from enabling auditing