@Mike Myers I though about https://osquery.io/schema/3.3.0#process_file_events , which would allow to map file system events on processes