https://github.com/osquery/osquery logo
#general
Title
# general
z

Zach Zeid

02/21/2020, 2:17 PM
does
ntfs_journal_events
log every change to every file on windows, or can it be scoped?
t

terracatta

02/21/2020, 2:19 PM
It can be scoped with the following config
Copy code
{
  "file_paths": {
    "downloads": [
      "C:\\Users\\foobar\\Downloads",
      "C:\\Users\\foobar\\Downloads\\*"
    ]
  }
}
z

Zach Zeid

02/21/2020, 2:20 PM
Thank you.
3 Views