Has anyone been able to monitor canary files and automate server disconnect and shutdown in case of a change?

I would like to have a monitor running to check a files contents every minute or 30 seconds and if the file can not be accessed or the content of the file has changes (i.e. ransomware) run an automation to disconnect the network ports and shut the server down. I have been trying to use the resource check for this, which is able to monitor the file. However, its tied to a full server. The problem here is that I ONLY want to run this automation if the resource check fails. I don't want to run the automation if lets say the hard disk is full. However the automation looks like it will run if ANY monitored attribute fails (such as disk space, process stopped etc), not just the resource check. We want to continue to monitor the servers for things like storage and services.

Any ideas?