I've been using Little Flocker, now discontinued, to monitor and control application's access to the filesystem, on macOS. I wonder if osquery can provide the monitoring part of Little Flocker - show all filesystem path accessed by processes, grouped by the process/application.