Also when we create file which is watched we don't see any CREATED file event, For delete file osquery reports only ATTRIBUTED_MODIFIED event not DELETED