Title
#general
Jams

Jams

03/11/2021, 5:15 PM
Hi. What are the differences between the file_events and process_file_events table? For example, one table leverages inotify publisher while the latter table requires the Linux audit framework.
Mike Myers

Mike Myers

03/11/2021, 5:38 PM
I see that the documentation on FIM is pretty out of date, it doesn't even mention process_file_events https://osquery.readthedocs.io/en/latest/deployment/file-integrity-monitoring/#file-integrity-monitoring-with-osquery