https://osquery.io/schema/3.3.0#file_events exists, but requires you to scope your list of monitored locations (EDIT: sorry, that is only change notifications, I see you already mentioned this)