does `ntfs_journal_events` log every change to eve...
# general
z
does
ntfs_journal_events
log every change to every file on windows, or can it be scoped?
t
It can be scoped with the following config
Copy code
{
  "file_paths": {
    "downloads": [
      "C:\\Users\\foobar\\Downloads",
      "C:\\Users\\foobar\\Downloads\\*"
    ]
  }
}
z
Thank you.