etsang
03/23/2021, 4:36 PMnyanshak
03/23/2021, 4:39 PMfile_accesses
with the folders in your osquery config? This is additional config on top of the file_paths
config that must be set up, because file accesses can be very noisy and have a lot of overhead. It's an explicit opt-in.etsang
03/23/2021, 5:02 PMzwass
03/23/2021, 5:16 PMls
would open the file thoughnyanshak
03/23/2021, 5:16 PMmore
though; seems like that should open the file?zwass
03/23/2021, 5:17 PMmore
would definitely open the fileetsang
03/23/2021, 5:21 PM