does

ntfs_journal_events

log every change to every file on windows, or can it be scoped?

It can be scoped with the following config

{
  "file_paths": {
    "downloads": [
      "C:\\Users\\foobar\\Downloads",
      "C:\\Users\\foobar\\Downloads\\*"
    ]
  }
}

Thank you.