wazuh-dashboard-plugins
wazuh-dashboard-plugins copied to clipboard
wazuh
Refactor FIM dashboard
Description
We want to refactor the FIM dashboard by removing all traces of angular, and implementing a new way of displaying dashboards using embeddable, which for the time being we only use in the new vulnerability dashboard.
Tasks
The steps that have to be complete to close the issue.
- [ ] Researching the FIM module
- [ ] Analysing, learning about and becoming familiar with embeddables
- [x] Implement logic with embeddables for the FIM dashboard
- [ ] Apply logic to display the corresponding dashboard taking into account whether or not the user has a pinned agent
- [x] #6210
- [ ] Analysing components to be adapted to be reusable for use in FIM
- [ ] #6325
Additional information
Add here any additional information relevant to the issue or that will help to close it: chunks of code, logs, additional error messages, related issues and so on.
I am currently investigating the FIM module as agreed during the sync with @gdiazlo and @asteriscos in order to find out its use cases and improve its dashboards.
Use cases
The Wazuh FIM module monitors directories to detect file changes, additions and deletions. This module is useful for monitoring important files on endpoints. You can use the FIM module for several purposes such as change management processes, regulatory compliance, and detecting cyberattacks. Below are examples of some use cases of the Wazuh FIM module.
Detecting malware persistence technique Detecting account manipulation Monitoring files at specific intervals Reporting file changes Monitoring configuration changes
How to best use existing use cases to create user-friendly dashboards?
- Based on what I read in the documentation https://documentation.wazuh.com/current/user-manual/capabilities/file-integrity/index.html where it mentions that one of the capabilities of the FIM module is to be able to know which user modified a certain file, which we can activate with the who-data https://documentation.wazuh.com/current/user-manual/capabilities/file-integrity/advanced-settings.html#who-data-monitoring, I think it would be useful to show this in a table in the Dashboard.
