I use osquery for linux at my job. But I find its regex capabilities for specifying paths and various file names very restrictive. I really want to use this for FIM.