security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update FIM integration Setup sequence (#3781)

Browse Source
This commit is contained in:
shashank-elastic
2024-06-12 16:40:45 +05:30
committed by GitHub
parent e3a72c6c47
commit 89d89f15d2
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/integrations/fim/persistence_suspicious_file_modifications.toml
+6 -6
View File
@@ -2,7 +2,7 @@
creation_date = "2024/06/03"
maturity = "production"
integration = ["fim"]
updated_date = "2024/06/03"
updated_date = "2024/06/12"
[rule]
author = ["Elastic"]
@@ -28,14 +28,14 @@ This rule requires data coming in from the Elastic File Integrity Monitoring (FI
### Elastic FIM Integration Setup
To configure the Elastic FIM integration, follow these steps:
1. Install and configure the Elastic Agent on your Linux system. You can refer to the [Elastic Agent documentation](https://www.elastic.co/guide/en/ingest-management/current/agent-configuration.html) for detailed instructions.
1. Install and configure the Elastic Agent on your Linux system. You can refer to the [Elastic Agent documentation](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html) for detailed instructions.
2. Once the Elastic Agent is installed, navigate to the Elastic Security app in Kibana.
3. In the Kibana home page, click on "Integrations" in the left sidebar.
4. Search for "File Integrity Monitoring" in the search bar and select the integration.
6. Provide a name and optional description for the integration.
7. Select the appropriate agent policy for your Linux system or create a new one.
8. Configure the FIM policy by specifying the paths that you want to monitor for file modifications. You can use the same paths mentioned in the `query` field of the rule. Note that FIM does not accept wildcards in the paths, so you need to specify the exact paths you want to monitor.
9. Save the configuration and the Elastic Agent will start monitoring the specified paths for file modifications.
5. Provide a name and optional description for the integration.
6. Select the appropriate agent policy for your Linux system or create a new one.
7. Configure the FIM policy by specifying the paths that you want to monitor for file modifications. You can use the same paths mentioned in the `query` field of the rule. Note that FIM does not accept wildcards in the paths, so you need to specify the exact paths you want to monitor.
8. Save the configuration and the Elastic Agent will start monitoring the specified paths for file modifications.
For more details on configuring the Elastic FIM integration, you can refer to the [Elastic FIM documentation](https://docs.elastic.co/integrations/fim).
"""