Troubleshooting Tip: Windows Agent Template -> File Integration Monitoring

[flunaibarra]

Description	This article describes how to troubleshoot the File Integration Monitoring on a Windows Agent template configuration.
Scope	Windows Agent v4.x.x - v7.3.x.
Solution	Prerequisites: The Windows Agent should be running actively and uploading other events. If other events are not being uploaded, follow the KB article to troubleshoot the Agent not uploading events: Troubleshooting Tip: Windows Agent registered with Supervisor but not uploading events FIM Template configuration: File/Directory: Should only point to a File name including extension or a Folder name. For the rest of the configuration options, see Define the Windows Agent Monitor Templates Guide:   Configuring Windows Agent - FortiSIEM user guide. Troubleshooting:  If the file name or folder path entered in the template configuration is incorrect, an event type AO-WUA-FileMon-Target-Missing will be created to alert. If the file or folder name is configured correctly, but FIM events are not generated/uploaded. Ensure the File Auditing and File System Auditing Policies are configured as the External Configuration indicated: Microsoft Windows Server via Agent. To filter only the FIM events in Analytic Query, use: Raw Event Log. CONTAIN. AccelOps-WUA-FileMon.