@thor Yep! I get it now osquery can monitor this file "known_hosts" and report if any abnormality is found? Unlike if there are any chef or salt scripts to execute some queries and fetch the results