Join Slack
Powered by
hmm, so after reading this it looks like file_acce...
# general
c
clong
03/08/2017, 8:18 PM
hmm, so after reading this it looks like file_accesses just uses the same file_paths that FIM uses as well? can i define a set of paths that are to be monitored for changes and a separate set of paths to be monitored for accesses?
https://github.com/theopolis/osquery/commit/ba4eeb6a804a698cfc9e18b0f9089d42a2a10f6b#diff-03234d7d84816b5ce2ee8a039a242928R90
Open in Slack
Previous
Next