@ex-parrot you'll need to use the FIM functionality (https://github.com/facebook/osquery/blob/master/docs/wiki/deployment/file-integrity-monitoring.md) if you want to catch events with inotify.