{
  "name": "fim",
  "title": "File Integrity Monitoring",
  "version": "1.17.0",
  "release": "ga",
  "description": "The File Integrity Monitoring integration reports filesystem changes in real time.",
  "type": "integration",
  "download": "/epr/fim/fim-1.17.0.zip",
  "path": "/package/fim/1.17.0",
  "icons": [
    {
      "src": "/img/sample-logo.svg",
      "path": "/package/fim/1.17.0/img/sample-logo.svg",
      "title": "Sample logo",
      "size": "32x32",
      "type": "image/svg+xml"
    }
  ],
  "conditions": {
    "kibana": {
      "version": "^9.2.0"
    }
  },
  "owner": {
    "type": "elastic",
    "github": "elastic/sec-linux-platform"
  },
  "categories": [
    "security"
  ],
  "signature_path": "/epr/fim/fim-1.17.0.zip.sig",
  "format_version": "3.0.0",
  "readme": "/package/fim/1.17.0/docs/README.md",
  "license": "basic",
  "screenshots": [
    {
      "src": "/img/fim-overview.png",
      "path": "/package/fim/1.17.0/img/fim-overview.png",
      "title": "FIM events overview dashboard",
      "type": "image/png"
    }
  ],
  "assets": [
    "/package/fim/1.17.0/LICENSE.txt",
    "/package/fim/1.17.0/changelog.yml",
    "/package/fim/1.17.0/manifest.yml",
    "/package/fim/1.17.0/validation.yml",
    "/package/fim/1.17.0/docs/README.md",
    "/package/fim/1.17.0/img/fim-overview.png",
    "/package/fim/1.17.0/img/sample-logo.svg",
    "/package/fim/1.17.0/kibana/tags.yml",
    "/package/fim/1.17.0/data_stream/event/manifest.yml",
    "/package/fim/1.17.0/data_stream/event/sample_event.json",
    "/package/fim/1.17.0/kibana/dashboard/fim-97c782f0-4291-11ee-a0f4-51818a115e85.json",
    "/package/fim/1.17.0/kibana/search/fim-6c045e50-4295-11ee-a0f4-51818a115e85.json",
    "/package/fim/1.17.0/data_stream/event/fields/agent.yml",
    "/package/fim/1.17.0/data_stream/event/fields/base-fields.yml",
    "/package/fim/1.17.0/data_stream/event/fields/ecs.yml",
    "/package/fim/1.17.0/data_stream/event/fields/package-fields.yml",
    "/package/fim/1.17.0/data_stream/event/agent/stream/file_integrity.yml.hbs",
    "/package/fim/1.17.0/data_stream/event/elasticsearch/ingest_pipeline/default.yml"
  ],
  "policy_templates": [
    {
      "name": "fim",
      "title": "File Integrity Monitoring",
      "description": "Collect filesystem events",
      "inputs": [
        {
          "type": "audit/file_integrity",
          "title": "Collect filesystem events",
          "description": "Collecting filesystem events"
        }
      ],
      "multiple": true
    }
  ],
  "data_streams": [
    {
      "type": "logs",
      "dataset": "fim.event",
      "title": "Filesystem events",
      "release": "ga",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "audit/file_integrity",
          "template_path": "file_integrity.yml.hbs",
          "title": "Filesystem events",
          "description": "Collect filesystem events",
          "enabled": true
        }
      ],
      "package": "fim",
      "path": "event"
    }
  ],
  "vars": [
    {
      "name": "paths",
      "type": "text",
      "title": "Paths to monitor",
      "description": "Paths (directories or files) to watch. Globs are not supported. The specified\npaths should exist when the module is started. Paths should be absolute,\nalthough the file integrity module will attempt to resolve relative path events to\ntheir absolute file path. Symbolic links are resolved at startup.\n",
      "multi": true,
      "required": true,
      "show_user": true,
      "default": [
        "/bin",
        "/usr/bin",
        "/sbin",
        "/usr/sbin",
        "/etc"
      ]
    },
    {
      "name": "recursive",
      "type": "bool",
      "title": "Recursive monitoring",
      "description": "Detect changes to files in subdirectories.",
      "multi": false,
      "required": false,
      "show_user": true,
      "default": false
    },
    {
      "name": "scan_at_start",
      "type": "bool",
      "title": "Scan at start",
      "description": "Scan over the configured file paths at startup and send events for new or\nmodified files since the last time the agent was running.\n",
      "multi": false,
      "required": false,
      "show_user": true,
      "default": true
    },
    {
      "name": "hash_types",
      "type": "text",
      "title": "Hash algorithms",
      "description": "Hash types to compute when the file changes. Supported types are:\n`blake2b_256`, `blake2b_384`, `blake2b_512`, `md5`, `sha1`, `sha224`, `sha256`, `sha384`,\n`sha512`, `sha512_224`, `sha512_256`, `sha3_224`, `sha3_256`, `sha3_384`, `sha3_512`, and `xxh64`.\n",
      "multi": true,
      "required": false,
      "show_user": true,
      "default": [
        "sha1"
      ]
    },
    {
      "name": "backend",
      "type": "select",
      "title": "File Event Source",
      "description": "Forces a particular event source for file events. `fsnotify` does not provide\nuser information.\n",
      "multi": false,
      "required": false,
      "show_user": true,
      "default": "auto"
    },
    {
      "name": "max_file_size",
      "type": "text",
      "title": "File size limit",
      "description": "Limit on the size of files that will be hashed.",
      "multi": false,
      "required": false,
      "show_user": false,
      "default": "100 MiB"
    },
    {
      "name": "scan_rate_per_sec",
      "type": "text",
      "title": "Scan rate",
      "description": "Average scan rate. This throttles the amount of CPU and I/O that will\nbe consumed at startup while scanning.\n",
      "multi": false,
      "required": false,
      "show_user": false,
      "default": "50 MiB"
    },
    {
      "name": "include_files",
      "type": "text",
      "title": "Include files",
      "description": "List of regular expressions used to explicitly include files.",
      "multi": true,
      "required": false,
      "show_user": false
    },
    {
      "name": "exclude_files",
      "type": "text",
      "title": "Exclude files",
      "description": "List of regular expressions used to explicitly include files. When configured,\nfiles will be ignored unless they match one of the patterns.\n",
      "multi": true,
      "required": false,
      "show_user": false,
      "default": [
        "(?i)\\.sw[nop]$",
        "~$",
        "/\\.git($|/)",
        "\\.tmp$",
        "\\.log$",
        "\\.db$"
      ]
    },
    {
      "name": "keep_null",
      "type": "bool",
      "title": "Keep null fields",
      "description": "Set to true to publish fields with null values",
      "multi": false,
      "required": false,
      "show_user": false,
      "default": false
    },
    {
      "name": "tags",
      "type": "text",
      "title": "Tags",
      "multi": true,
      "required": false,
      "show_user": false,
      "default": [
        "fim-event"
      ]
    },
    {
      "name": "processors",
      "type": "yaml",
      "title": "Processors",
      "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata.\nThis executes in the agent before the logs are parsed.\nSee [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n",
      "multi": false,
      "required": false,
      "show_user": false
    }
  ],
  "agent": {
    "privileges": {
      "root": true
    }
  }
}