Is osquery able to detect what files/folders in a system are accessed including just a READ? I would like to find out the entire set of files/folders or other assets accessed without knowing the list beforehand. Most other monitor tools you have to know what you want to monitor first. Anyone with example will be appreciated.

the answer might depend on which OS you're running

linux. I am new to osquery. I am doing an research on the tool for profiling application running on linux (what resources an running application is actually accessing/changing in a linux system, we can just assume redhat enterprise or any type of linux for an example).

Ok, I think Linux has two subsystems that osquery can use for file event monitoring: iNotify (

file_events

https://osquery.io/schema/4.6.0/#file_events) and Audit (in

process_file_events

https://osquery.io/schema/4.6.0/#process_file_events)

thanks, yes it is to build up an initial list from the unknown, then filter down to the set of desired set of list eventually when it becomes clear what to look for.