Added force_backend configuration key to fim integration

elastic · Jan 16, 2024 · d9d081f · d9d081f
1 parent 3840a7f
commit d9d081f
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 0 deletions.
diff --git a/packages/fim/data_stream/event/agent/stream/file_integrity.yml.hbs b/packages/fim/data_stream/event/agent/stream/file_integrity.yml.hbs
@@ -5,6 +5,7 @@ paths:
 {{/each}}
 recursive: {{recursive}}
 scan_at_start: {{scan_at_start}}
+force_backend: {{force_backend}}
 hash_types:
 {{#each hash_types as |hash i|}}
   - {{hash}}

diff --git a/packages/fim/manifest.yml b/packages/fim/manifest.yml
@@ -72,6 +72,16 @@ vars:
     required: false
     default:
       - sha1
+  - name: force_backend
+    type: text
+    title: File Event Source
+    description: |
+      Forces a particular event source for file events on Linux. `fsnotify` does not provide
+      user information. Supported types are:
+      `ebpf`, `fsnotify`, `kprobe`.
+    show_user: true
+    required: false
+    default: fsnotify
   - name: max_file_size
     type: text
     title: File size limit