File Access

File Access events report accesses to sensitive files, such as password files. In this release, the list of files to be monitored cannot be changed by users. In Linux, the sensor monitors write access to /etc/passwd. Sensor also monitors read and write accesses to /etc/shadow. Windows will not trigger this event in this release.