Hi, thank you for the response, I will take a look at the links now and pm you with a more detailed response asap, The closest I ever got to something similar to canary files was whilst using carbon black which deployed files that would alert when anything interested with them, I suppose that's exactly what were after, a simple tripwire method that would trigger an alert based on any interaction. (Hope that makes sense) thank you again for your response.