Alienvault integration

[reza fathi]

Hi,
How can I integrate wazuh with alienvault in order to get malware hashes and use them with FIM to detect dangerous files in our network?

Regards,
Reza.

[Mateo Cervilla]

Hi,

File Integrity Monitoring (FIM) is a security process used to monitor the integrity of system and application files.

You can take a look to the documentation here:

• File integrity monitoring
  
  • How it works
    
  • How to configure the FIM module
    
  • Creating custom FIM rules
    
  • Use cases

FIM stores the files checksums and other attributes in a local FIM database. Upon a scan, the Wazuh agent reports any changes the FIM module finds in the monitored paths to the Wazuh server. The FIM module looks for file modifications by comparing the checksums of a file to its stored checksums and attribute values.

I don't know if this is the tool you are looking for. Can you elaborate a bit more about Alienvault and what you need to do with it?

Regards