From 7d6aaef4041fbe3d0a0282deb4f987561a361dc0 Mon Sep 17 00:00:00 2001 From: "Scott R. Shinn" Date: Wed, 5 Aug 2026 13:46:54 -0400 Subject: [PATCH] Document Windows FIM check_acl and NTFS permissions FAQ. Cover opt-in check_acl syntax, ACE alert details, and first-enable baseline guidance alongside check_attrs. --- docs/faq/syscheck.rst | 46 ++++++++++++++++++++++++++ docs/syntax/ossec_config.syscheck.trst | 32 ++++++++++++++++-- 2 files changed, 76 insertions(+), 2 deletions(-) diff --git a/docs/faq/syscheck.rst b/docs/faq/syscheck.rst index a5bd70d0..a1d1500c 100644 --- a/docs/faq/syscheck.rst +++ b/docs/faq/syscheck.rst @@ -122,6 +122,52 @@ Why does auto_ignore not suppress noisy realtime alerts? from the realtime monitoring path are not subject to ``auto_ignore``. Use ```` or a local rule for files that change frequently in realtime directories. +Can OSSEC monitor Windows Hidden files? +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +Yes. Syscheck already enumerates and checksums files with the Windows Hidden +attribute; content changes are reported like any other file. + +To **alert when the Hidden (or other) attribute itself changes**, enable +``check_attrs`` on the monitored directory (Windows agents only). This is not +part of ``check_all``: + +.. code-block:: xml + + + C:\\path\\to\\watch + + +The first scan after enabling ``check_attrs`` may re-baseline those paths +(attribute field added to the sum). Use FIM maintenance mode or +``syscheck_control -u`` if you need a quiet transition. + + +Can OSSEC monitor Windows NTFS permissions (ACLs)? +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +Yes. Enable ``check_acl`` on the monitored directory (Windows agents only). +This is **not** part of ``check_all``, and it is separate from Unix +``check_perm`` (POSIX mode bits). + +.. code-block:: xml + + + C:\\path\\to\\watch + + +OSSEC stores a compact SID-stable digest in the integrity sum and attaches +human-readable ACE details (including inheritance flags and Added/Removed/Modified +sections) on change alerts. Account display-name renames without an ACL edit do +not raise an alert. + +The first scan after enabling ``check_acl`` may re-baseline those paths. Use FIM +maintenance mode or ``syscheck_control -u`` if you need a quiet transition. + + +How do I get alerts for new files? +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + Add the following to local_rules.xml only if you want a higher alert level than the default (5): diff --git a/docs/syntax/ossec_config.syscheck.trst b/docs/syntax/ossec_config.syscheck.trst index 4ee266c3..00ae86c3 100644 --- a/docs/syntax/ossec_config.syscheck.trst +++ b/docs/syntax/ossec_config.syscheck.trst @@ -17,8 +17,11 @@ Realtime mode alerts immediately on **file content integrity** changes (checksums and size) for files already in the syscheck database. Permission, ownership, and - group changes are detected on the **next scheduled scan**, not instantly. See - :ref:`syscheck-realtime-limits`. + group changes are detected on the **next scheduled scan**, not instantly. On + Windows, when ``check_attrs="yes"`` is set, attribute changes (for example Hidden) + are also eligible for realtime notification; when ``check_acl="yes"`` is set, + NTFS DACL/security changes are likewise eligible via + ``FILE_NOTIFY_CHANGE_SECURITY``. See :ref:`syscheck-realtime-limits`. - **report_changes**: Value=yes @@ -67,6 +70,31 @@ - Check the UNIX permission of the files/directories selected. On windows this will only check the POSIX permissions. + - **check_attrs**: Value=yes + + .. versionadded:: 4.3.0 + + - On Windows, include ``GetFileAttributes`` bits (Hidden, System, + Archive, and related) in the FIM integrity sum so attribute flips + alert. Ignored on non-Windows agents. Not enabled by ``check_all``; + set explicitly to avoid a one-time baseline churn on upgrade. + + **Allowed:** yes/no + + - **check_acl**: Value=yes + + .. versionadded:: 4.3.0 + + - On Windows, monitor NTFS DACL/ACE changes (ALLOW/DENY matrix with + inheritance flags). Change detection uses a SID-stable digest in the + FIM sum; alert text includes Added/Removed/Modified ACE details when + permissions change. Ignored on non-Windows agents (safe in portable + ``agent.conf``). Not enabled by ``check_all``; enable explicitly and + expect a one-time baseline when first turned on (use FIM maintenance + mode or ``syscheck_control -u`` for a quiet transition). + + **Allowed:** yes/no + - **restrict**: Value=string - A string that will limit checks to files containing that string in the file name.