@clong good point, that makes sense. do you know of anyone who has talked about how they operationalized fim using osquery? it seems difficult to respond to those events w/o the context of a file diff