1. A system comprising: one or more processors; and a memory communicatively coupled to the one or more processors, the memory including monitoring logic being communicatively coupled with and remotely located from a file system via an Application Programming Interface (API), the monitoring logic, when executed by the one or more processors, being configured to monitor for and detect a notification message that is directed to a destination other than the monitoring logic and identify a state change event that represents an activity causing a change in state of a data store associated with the file system to occur, the notification message, at least in part, triggering a malware analysis to be conducted on an object associated with the state change event.