Scott R. Shinn

Im not sure I understand the question here

There are a few different ways to handle that. The condition here is that you're adding an new agent and the database for that system is empty at that point....

Yup! an ossec server has all the same functionality built in that an ossec agent does. So its going to run FIM, rootcheck, log IDS, etc

Can you tell me more about the environment? Im using this on el8 (rocky linux), and I'm trying to reproduce it

A ha, and DNS resolution works correctly in your environments?

Wouldnt something like this work? After=network.target

Id say more for backwards compatibility with 3rd party integrations out there. We'll keep md5 in there to not break those things, but rely on sha256 for the future FIM...

Tagged as stale/closed if no further responses in 7 days

Sure, the current selinux policy is here: https://github.com/ossec/ossec-hids/tree/master/contrib/selinux, can you make an update there and send us a pull request?

In linux I can see how you'd do it by looking at the mount type. Is that even something you can get from windows?