The documentation suggests you can use wildcards, https://osquery.readthedocs.io/en/latest/deployment/file-integrity-monitoring/ Did you find otherwise?

but it doesn’t seem to be filtering it out. I’ll do some more specific tests and I’ll report back

is there any table in osquery where I can see this configuration?

it seems that exact match does work, but

%

and

%%

don’t, this was the config:

exclude_paths:
      homes:
        - /home/joao.godinho/file.txt
        - /home/joao.godinho/test%%
        - /home/joao.godinho/test%

this should be identical to the one in the

file_paths

validation, right?

follow up question on this as a work around for now; if I query

file_events

with a WHERE clause to exclude some files, will the excluded file events be considered “consumed” and removed from the table when the expiry triggers?