Configure files path and directories at Wazuh Manager

[Adithya Varma]

Hi All,

I have wazuh server with 100+ agent which including windows server and linux server for only focus for FIM monitoring. Currently I'm looking that can wazuh do centralize critical path configuration at wazuh manager instead of configure at each of wazuh agent? 

[Cedrick Foko]

Hi Adithya,

Thank you for using Wazuh.

You can centralize any agent's configuration using groups. For instance, if you want to configure FIM to monitor the /media/user/test/ directory in all your Linux agents, you may follow the below process.

On your dashboard, click on wazuh drop down menu, select Management, Then Groups.

On the Groups page, click on Add new group, enter the group name and click on Save new group.

Open the group details by clicking on the eye in Actions column. On the group details page, click on Manage agents.

Now select your Linux agents in the list of agents and click on Add selected items, then Apply changes to add them to the group.

Get back to the group page and edit the group configuration by clicking on the pen in Actions column.

Add the following bloc into <agent_config> bloc:

<syscheck>
  <directories check_all="yes" realtime="yes">/media/user/test</directories>
</syscheck>

Click on Save to save the group configuration.

You may follow the same process for Windows agents.

You can find more information regarding grouping agents' configuration in our documentation: Grouping agents - Agent management · Wazuh documentation
Centralized configuration (agent.conf) - Reference (wazuh.com)

I hope you find this helpful. Don't hesitate to ask if you have any other question.

[Adithya Varma]

Thank you so much. it's very much appreciated. 

[Cedrick Foko]

Hello Adithya,

Thank you for your feedback.

Please don't hesitate to contact us should you need any further help.

Kind regards,