Skip to main content
Integrity Monitoring — formerly File Integrity Monitoring — tracks and reports real-time changes to system files, directories, and Windows Registry keys on your managed endpoints. Endpoint agents such as Wazuh feed it continuously, giving you visibility into unauthorized modifications, file additions and deletions, and registry tampering.

​
Key concepts

  • Endpoint agent — background software installed on managed hosts that watches file system activity and registry hives in real time.
  • File integrity — tracking changes to critical system files, capturing the file path, the modifying user, that user’s ID, the last modification timestamp, and the last scan time.
  • Registry integrity — monitoring Windows Registry keys and values to detect persistence mechanisms, configuration drift, and policy violations.
  • Integrity event — a single reported modification, creation, or deletion of a monitored file or registry key.

​
No charts in this module

Integrity Monitoring is a data grid and a read-only host inspector. It has no summary charts, time-series graphs, or metric cards — every metric is presented through structured tables.