Using osquery to monitor access to decoy files