@groob Yes, something like

lsof

, but showing all of the paths accessed by the applications, not only the ones open when

lsof

command is executed. That's why FIM feature of osquery looks so promising. I ask if it could be possible, because https://blog.trailofbits.com/2017/12/21/osquery-pain-points/ states, that while file events are OK on macOS, file events with PID are problematic.