Wazuh File Integrity Monitoring (FIM), powered by the syscheck module, watches files and directories for additions, modifications and deletions. It is required for PCI DSS 11.5, HIPAA, NIST 800-53 and most other compliance frameworks.
1. Enable syscheck in agent.conf
<syscheck>
<disabled>no</disabled>
<frequency>43200</frequency>
<directories check_all="yes" realtime="yes">/etc,/usr/bin,/usr/sbin</directories>
<directories check_all="yes" whodata="yes">/root</directories>
<ignore>/etc/mtab</ignore>
<ignore type="sre">^/etc/.*\.tmp$</ignore>
</syscheck>2. Real-time vs scheduled scans
- realtime="yes", uses inotify on Linux / ReadDirectoryChangesW on Windows for instant alerts
- whodata="yes", adds the user, process and PID that made the change (requires auditd on Linux)
- frequency, baseline rescan interval in seconds (default 12 hours)
3. Apply changes
systemctl restart wazuh-agent4. Test an alert
Touch a monitored file and verify the alert in the dashboard under Threat Hunting -> Events:
echo "test" >> /etc/hostsNote: Avoid monitoring /var/log or /tmp in real time, they generate huge volumes of noise. Whitelist them with <ignore>.
We build PCI/HIPAA-ready FIM policies that pass audits without alert fatigue, contact us for a hardening review.
Official reference
Commands and configuration in this guide are based on the official Wazuh documentation. For the canonical source, see:
WazuhFIMSyscheckCompliance