Troubleshooting Tip: Windows Agent Template -> File Integration Monitoring

Prerequisites:

• The Windows Agent should be running actively and uploading other events.
• If other events are not being uploaded, follow the respective articles below to troubleshoot when:
  • Windows Agent registers with Supervisor but does not upload events: Troubleshooting Tip: Windows Agent registered with Supervisor but not uploading events.
  • Windows Agent is registered with the Collector as a Proxy: Windows Agent registration with Collector as Proxy and troubleshooting.

FIM Template configuration:

File/Directory: Should only point to a File name including extension or a Folder name.

For the rest of the configuration options, see Define the Windows Agent Monitor Templates Guide:  
Configuring Windows Agent - FortiSIEM user guide.

Troubleshooting: 

If the file name or folder path entered in the template configuration is incorrect, an event type AO-WUA-FileMon-Target-Missing will be created to alert.

If the file or folder name is configured correctly, but FIM events are not generated/uploaded. Ensure the File Auditing and the File System Auditing Policies are configured as the External Configuration indicated:
Microsoft Windows Server via Agent - Configuring File Integrity Monitoring

To filter only the FIM events in Analytic Query, use:

• Raw Event Log.
• CONTAIN.
• AccelOps-WUA-FileMon.