# wazuh-file-integrity-monitoring

Companion files for the lesson [Wazuh File Integrity Monitoring Setup](https://maheshtata.com/wazuh/wazuh-file-integrity-monitoring/).

Tested against the Wazuh 5.0 beta5 documentation (September 2026). Wazuh 5.0 is
still in beta, so treat every value as subject to change at GA.

| File | What it is | Where it goes |
| --- | --- | --- |
| `agent.conf` | Shared FIM configuration for an agent group, with separate Linux and Windows blocks | `/var/wazuh-manager/etc/shared/<GROUP_NAME>/agent.conf` on the manager |
| `ossec.conf.fragment.xml` | Local `<syscheck>` fragment for a single endpoint | merge into the agent's `ossec.conf` |

Both files are fragments of a working configuration rather than complete
drop-in replacements. The agent ships a default `<syscheck>` block; merge these
paths into it instead of overwriting the file.

## Order of operations

1. Create the group on the manager before any agent enrols into it, or
   enrolment is rejected.
2. Write `agent.conf.tmp`, then validate it:
   `/var/wazuh-manager/bin/verify-agent-conf /var/wazuh-manager/etc/shared/<GROUP_NAME>/agent.conf.tmp`
3. Rename it to `agent.conf`. The manager distributes it automatically.

## Notes

- Centralised configuration overrides the agent's local file for the same
  directory.
- Real-time directories must exist when the agent starts.
- UNC paths and mapped network drives are not supported on Windows in any FIM
  mode.
- Only one who-data provider takes effect per agent: the last one configured.