<!--
  Local agent FIM fragment, for a single endpoint or a lab.

  Merge the <syscheck> block into the existing <ossec_config> root of:
    Linux    /var/ossec/etc/ossec.conf
    Windows  C:\Program Files (x86)\ossec-agent\ossec.conf
    macOS    /Library/Ossec/etc/ossec.conf

  This is a fragment, not a complete configuration file: the agent ships a
  default <syscheck> block, so merge rather than replace.

  Apply with:
    Linux    systemctl restart wazuh-agent
    Windows  Restart-Service WazuhSvc
    macOS    /Library/Ossec/bin/wazuh-control restart

  Lesson: https://maheshtata.com/wazuh/wazuh-file-integrity-monitoring/
-->

<ossec_config>

  <syscheck>
    <disabled>no</disabled>

    <!-- Seconds between scheduled scans. 43200 is the documented default. -->
    <frequency>43200</frequency>

    <!-- Or pin scans to a quiet window instead of a fixed interval:
    <scan_time>10pm</scan_time>
    <scan_day>saturday</scan_day>
    -->

    <directories check_all="yes" realtime="yes">/etc/nginx</directories>
    <directories check_all="yes">/usr/local/bin</directories>

    <!-- Who-data in eBPF mode. Requires kernel 5.8 or higher; on older
         kernels the module falls back to the audit provider. -->
    <directories check_all="yes" whodata="yes">/etc/ssh/sshd_config</directories>
    <whodata>
      <provider>ebpf</provider>
      <queue_size>50000</queue_size>
    </whodata>

    <ignore>/etc/nginx/nginx.pid</ignore>
    <ignore type="sregex">.log$|.tmp$</ignore>
  </syscheck>

</ossec_config>
