Agent for a file server

Bakotech

Hi,
Could you advice what kind of agent should I use for a File server?
I want to track follow info:
Who, when and from where visited particular directory and what changes he performed in a directory. (for example if he copied, deleted or changed file).

SzymonC

Hi,
You can either go with beat agent or siem agent for file integrity monitroing.

In case of best agent, use Auditbeat. You can download OSS version here.
Details are described here.

In case of SIEM agent you have to configure FIM in agent configuration. It is a little more complicated but also advanced.
Description
Configuration

Bakotech

SzymonC
Thanks for the answer, I was able to configure FIM through WAZUH, changes were made in the configuration file on the agent.

The information started to arrive on the dashboard and in the Wazuh log files

I noticed that when I make changes on a local file that I track, I can see in the logs all the changes, namely what was added to the file

But when I make changes in a shared file I do not see the changes that were made to this file. How can I solve this problem ?

SzymonC

Hi,

That is a great question and good find! I've been testing this during a weekend because i couldn't make it work also.
Right now change monitoring for remote files is not supported. This is due to mechanism used for that - Windows fc (file compare) - which is not able to process difference between local and remote file. You can read more about it here:
https://docs.microsoft.com/en-us/troubleshoot/windows-client/shell-experience/how-to-use-windiff-utility

We've created an internal issue about that. It will be fixed in future releases of Energy Logserver.
Thank you for the help in improving our solution 🙂