# Elastic agent and osquery file integrity monitoring (FIM) integration

**URL:** <https://discuss.elastic.co/t/elastic-agent-and-osquery-file-integrity-monitoring-fim-integration/369159>\
**Category:** Elastic Agent\
**Created:** [October 21, 2024, 2:50pm UTC](https://discuss.elastic.co/t/elastic-agent-and-osquery-file-integrity-monitoring-fim-integration/369159 "2024-10-21T14:50:26Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![ganrt](https://avatars.discourse-cdn.com/v4/letter/g/a9adbd/32.png) [@ganrt](https://discuss.elastic.co/u/ganrt)\
**Post date:** [October 21, 2024, 2:50pm UTC](https://discuss.elastic.co/t/elastic-agent-and-osquery-file-integrity-monitoring-fim-integration/369159/1 "2024-10-21T14:50:26Z")

</div>

Hello,  
I would like to know how to enable the FIM using the agent and the integration of osquery manager, I have set up some configuration according to the documentation of osquery for windows, however it refuses to work, this is my config:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/2/82268e8bc09ddd395acb9ca62f55746f8940bf4d.png)

and this to the integration configuration:  
{  
"options": {  
"disable\_events": false,  
"enable\_ntfs\_event\_publisher": true  
},  
"packs": {}  
}

this log might indicate that the configuration is enable however the schedule query return nothing after a while and some change made to the target path:  
{"log.level":"info","@timestamp":"2024-10-21T15:01:51.912Z","message":"The minimum events expiration timeout for ntfs\_journal\_events has been adjusted: 10860","component":{"binary":"osquerybeat","dataset":"elastic\_agent.osquerybeat","id":"osquery-default","type":"osquery"},"log":{"source":"osquery-default"},"log.origin":{"file.line":84,"file.name":"beater/logger\_plugin.go"},"osquery.filename":"eventfactory.cpp","osquery.cal\_time":"Mon Oct 21 15:01:50 2024 UTC","ecs.version":"1.6.0","log.logger":"osquerybeat","osquery.log\_type":"status","osquery.severity":0,"osquery.time":1729522910,"service.name":"osquerybeat","ctx":"logger","osquery.line":352,"ecs.version":"1.6.0"}