Disable other Modules

[Adithya Varma]

Hi All,

I want to use wazuh for FIM monitoring only. May how to disable/remove other modules?

Besides, is there any other way we can restrict at agent level to collect FIM related logs only? 

[Harshal Paliwal]

Hi Team,
Thanks for using the wazuh.Yes, you can use only FIM monitoring for the agent.
For that, you can disable the other modules from the /var/ossec/etc/ossec.conf and keep the modules you want the logs.
For FIM you need to enable the <syscheck> which grabs the details from the agents.
After you update this file you need to restart your wazuh-agent using below command:systemctl restart wazuh-agentReference:
https://documentation.wazuh.com/current/user-manual/capabilities/file-integrity/index.html
https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/index.htmlHope this information helps you. Please feel free to reach out to us for any information/issues.