Title
#general
z

Zach Zeid

02/21/2020, 2:17 PM
does
ntfs_journal_events
log every change to every file on windows, or can it be scoped?
terracatta

terracatta

02/21/2020, 2:19 PM
It can be scoped with the following config
{
  "file_paths": {
    "downloads": [
      "C:\\Users\\foobar\\Downloads",
      "C:\\Users\\foobar\\Downloads\\*"
    ]
  }
}
z

Zach Zeid

02/21/2020, 2:20 PM
Thank you.