@pickmansec if you're using FIM, define a category for that file or patten, then opt it into the `file_accesses`: https://osquery.readthedocs.io/en/stable/deployment/file-integrity-monitoring/#file-accesses