Config excerpt is below:
#path.home:
path.config: ${path.home}/fim/conf
path.data: ${path.home}/fim/data
path.logs: ${path.home}/logs
keystore.path: "${path.config}/fim.keystore"
auditbeat.config.modules:
path: ${path.config}/conf.d/*.yml
reload.period: 10s
reload.enabled: true
auditbeat.max_start_delay: 10s
auditbeat.modules:
- module: file_integrity
paths:
- C:/windows
- C:/windows/system32
- C:/Program Files
- C:/Program Files (x86)
exclude_files:
- '(?i)\.lnk$'
- '(?i)\.swp$'
scan_at_start: true
scan_rate_per_sec: 50 MiB
max_file_size: 100 MiB
hash_types: [sha1]
recursive: true