# File integrity monitoring integration to get current filesystem state

**URL:** <https://discuss.elastic.co/t/file-integrity-monitoring-integration-to-get-current-filesystem-state/356277>\
**Category:** Elastic Agent\
**Created:** [March 27, 2024, 11:58am UTC](https://discuss.elastic.co/t/file-integrity-monitoring-integration-to-get-current-filesystem-state/356277 "2024-03-27T11:58:28Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![pstmps](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pstmps/32/132993_2.png) [@pstmps](https://discuss.elastic.co/u/pstmps)\
**Post date:** [March 27, 2024, 11:58am UTC](https://discuss.elastic.co/t/file-integrity-monitoring-integration-to-get-current-filesystem-state/356277/1 "2024-03-27T11:58:28Z")

</div>

I am using elastic agent and the file integrity monitoring integration (1.14.1) to watch a folder and its subfolders for changes.

This works fine but in order to get the true state of the filesystem I have to condense the "raw filesystem events" reported by the integration in order to get the state of the filesystem at that point in time.

I am using an external (script as a) service to do this (aggregate, sort by timestamp, what kind of event? handle accordingly), but is there an internal way of doing this using only the elastic stack?

I have tried using a continous transform but havent had much luck, it works on file based events, but if a folder is deleted for example, I have to delete all files contained, which I dont think I can do in a transform (or can I?).

Another idea was to use Ingest Pipeline processing to do that on incoming events, but other than enriching the datastream with more fields I couldnt figure this out either.

But then again, I am not that smart! Maybe there is an easy solution I am missing? Thanks

tl;dr Can you create a filesystem state from raw events logged from the fim integration using the elastic stack or do you need an outside entity to query, filter and delete?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 26, 2024, 11:57am UTC](https://discuss.elastic.co/t/file-integrity-monitoring-integration-to-get-current-filesystem-state/356277/3 "2024-04-26T11:57:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.