Yes, I've entered this section "file_paths": { "monitor_this": [ "/etc/%%", "/temp/%" ] } I've tried to create a file or a folder in etc or in a subfolder to test the event monitoring.