You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: source/user-manual/wazuh-indexer/wazuh-indexer-indices.rst
-42Lines changed: 0 additions & 42 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,8 +13,6 @@ An index is a collection of documents that relate to each other. The Wazuh index
13
13
- :ref:`wazuh‑monitoring-* <wazuh_monitoring_indices>`: This is the index pattern for the status of the Wazuh agents.
14
14
- :ref:`wazuh‑statistics-* <wazuh_statistics_indices>`: This is the index pattern that shows the performance metrics of the Wazuh server. It contains information that shows how many events are received, processed and dropped by the Wazuh server.
15
15
- :ref:`wazuh-states-vulnerabilities-* <wazuh_states_vulnerabilities_indices>`: This is the index pattern for information about vulnerabilities detected in the endpoints being monitored.
16
-
- :ref:`wazuh-states-fim-files-* <wazuh_states_fim_files_indices>`: This is the index pattern for monitored files and directories on monitored endpoints.
17
-
- :ref:`wazuh-states-fim-registries-* <wazuh_states_fim_registries_indices>`: This is the index pattern for Windows registry files on a monitored endpoint.
18
16
- :ref:`wazuh-states-inventory-hardware-* <wazuh_states_inventory_hardware_indices>`: This is the index pattern for basic information about hardware components on a monitored endpoint.
19
17
- :ref:`wazuh-states-inventory-hotfixes-* <wazuh_states_inventory_hotfixes_indices>`: This is the index pattern for updates installed on a Windows endpoint. The Wazuh vulnerability detection module uses this to discover what vulnerabilities have been patched on a Windows endpoint.
20
18
- :ref:`wazuh-states-inventory-interfaces-* <wazuh_states_inventory_interfaces_indices>`: This is the index pattern for ``up`` and ``down`` status information, and packet transfer information about network interfaces on a monitored endpoint.
@@ -509,46 +507,6 @@ To visualize this information in the Wazuh dashboard, click on **Vulnerability D
509
507
:align: center
510
508
:width: 80%
511
509
512
-
.. _wazuh_states_fim_files_indices:
513
-
514
-
The wazuh-states-fim-files-* indices
515
-
------------------------------------
516
-
517
-
The ``wazuh-states-fim-files-*`` index stores information about files and directories being monitored by the Wazuh File Integrity Monitoring (FIM) module. Each record within this index represents the state of a file or directory on an endpoint at the time it was scanned. This includes metadata such as file paths, permissions, ownership, and cryptographic hashes.
518
-
519
-
By keeping track of these details, the index provides a baseline snapshot of the monitored file systems. When changes occur, like a file being created, modified, or deleted, Wazuh can compare the new state against the information in this index to quickly detect anomalies.
520
-
521
-
In practical terms, this index serves as a historical ledger of the monitored endpoint's file system, ensuring that system integrity can be validated and investigated whenever suspicious activity arises. For example, if you navigate to **File Integrity Monitoring** > **Inventory** > **Files**, you will see information relating to monitored files.
The ``wazuh-states-fim-registries-*`` index stores information collected by the Wazuh File Integrity Monitoring (FIM) module for the Windows Registry on the monitored endpoint. Each document in this index represents the state of a monitored registry key or value, including details such as key paths, permissions, and associated values.
535
-
536
-
This index acts as a reference point for detecting changes in the Windows Registry. When a key or value is created, modified, or removed, Wazuh compares the new state against the records stored here, allowing administrators to spot unauthorized or suspicious changes.
537
-
538
-
The Windows Registry is often a target for persistence mechanisms, privilege escalation, and configuration tampering; therefore, this index is important for monitoring system integrity on Windows endpoints. For example, if you navigate to **File Integrity Monitoring** > **Inventory** > **Registry keys** or **Registry values**, you will see information relating to Windows registry keys and values.
0 commit comments