From 89d89f15d22f5068fb7ce505aaeb8a6c2e49ff4a Mon Sep 17 00:00:00 2001
From: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>
Date: Wed, 12 Jun 2024 16:40:45 +0530
Subject: [PATCH] Update FIM integration Setup sequence (#3781)

---
 .../persistence_suspicious_file_modifications.toml   | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/rules/integrations/fim/persistence_suspicious_file_modifications.toml b/rules/integrations/fim/persistence_suspicious_file_modifications.toml
index 81d982e25..cfae1151c 100644
--- a/rules/integrations/fim/persistence_suspicious_file_modifications.toml
+++ b/rules/integrations/fim/persistence_suspicious_file_modifications.toml
@@ -2,7 +2,7 @@
 creation_date = "2024/06/03"
 maturity = "production"
 integration = ["fim"]
-updated_date = "2024/06/03"
+updated_date = "2024/06/12"
 
 [rule]
 author = ["Elastic"]
@@ -28,14 +28,14 @@ This rule requires data coming in from the Elastic File Integrity Monitoring (FI
 ### Elastic FIM Integration Setup
 To configure the Elastic FIM integration, follow these steps:
 
-1. Install and configure the Elastic Agent on your Linux system. You can refer to the [Elastic Agent documentation](https://www.elastic.co/guide/en/ingest-management/current/agent-configuration.html) for detailed instructions.
+1. Install and configure the Elastic Agent on your Linux system. You can refer to the [Elastic Agent documentation](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html) for detailed instructions.
 2. Once the Elastic Agent is installed, navigate to the Elastic Security app in Kibana.
 3. In the Kibana home page, click on "Integrations" in the left sidebar.
 4. Search for "File Integrity Monitoring" in the search bar and select the integration.
-6. Provide a name and optional description for the integration.
-7. Select the appropriate agent policy for your Linux system or create a new one.
-8. Configure the FIM policy by specifying the paths that you want to monitor for file modifications. You can use the same paths mentioned in the `query` field of the rule. Note that FIM does not accept wildcards in the paths, so you need to specify the exact paths you want to monitor.
-9. Save the configuration and the Elastic Agent will start monitoring the specified paths for file modifications.
+5. Provide a name and optional description for the integration.
+6. Select the appropriate agent policy for your Linux system or create a new one.
+7. Configure the FIM policy by specifying the paths that you want to monitor for file modifications. You can use the same paths mentioned in the `query` field of the rule. Note that FIM does not accept wildcards in the paths, so you need to specify the exact paths you want to monitor.
+8. Save the configuration and the Elastic Agent will start monitoring the specified paths for file modifications.
 
 For more details on configuring the Elastic FIM integration, you can refer to the [Elastic FIM documentation](https://docs.elastic.co/integrations/fim).
 """