Open oliveiralive opened 2 years ago
Hi @oliveiralive,
Unfortunately, at the moment, FIM only supports sregex
expressions, given its quickness. With this type of expressions, it is not possible to filter every file, which names start with "~$", as it is not that flexible.
You can find more information regarding Wazuh's regex types on the following link: https://documentation.wazuh.com/current/user-manual/ruleset/ruleset-xml-syntax/regex.html
Also here is the documentation of the FIM's ignore
label where it says that only sregex
is supported: https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/syscheck.html#ignore. Currently, the only possible option is to explicitly ignore these files.
This kind of community question is becoming frequent, so I will be opening a feature request asking for FIM to accept the other regex types, such as pcre2 and os_regex. After doing so, I will be linking the issues, so please stay tuned.
Best Regards,
Mariano Koremblum
Bump. After hours of trying things, I came across this article and discovered that even now, those office temp files will constantly trigger alerts on each save. In my case, it is the .lnk files created in the %appdata%\Roaming\Microsoft\Office\Recent folder.
|Wazuh version|Component|Install type|Install method|Platform| |4.2.3--------------|---|---|-----------------------------------------|-| | X.Y.Z-rev | Wazuh component | Manager/Agent | Packages/Sources | OS version | | Centos8 | I want know if is possible ignore temp files on File Integrity Monitoring
When the user edit a office file, the office make a new temp file in the folder like bellow![image](https://user-images.githubusercontent.com/35010493/139264608-a8a7fffb-530f-4200-909c-367b9b33a5f3.png)
and the wazuh FIM register the information with creat and delet![image](https://user-images.githubusercontent.com/35010493/139263989-650c7f48-0434-4866-9fab-f0c58192bc07.png)
I try to put this temp file with exception in the wazuh agent config file like below but not work![image](https://user-images.githubusercontent.com/35010493/139265802-06a7bb7d-8d2b-4de0-af9f-3d3329d5e353.png)
anyone know with do this?