{"action":"created","issue":{"url":"https://api.github.com/repos/wazuh/wazuh/issues/1752","repository_url":"https://api.github.com/repos/wazuh/wazuh","labels_url":"https://api.github.com/repos/wazuh/wazuh/issues/1752/labels{/name}","comments_url":"https://api.github.com/repos/wazuh/wazuh/issues/1752/comments","events_url":"https://api.github.com/repos/wazuh/wazuh/issues/1752/events","html_url":"https://github.com/wazuh/wazuh/issues/1752","id":374967833,"node_id":"MDU6SXNzdWUzNzQ5Njc4MzM=","number":1752,"title":"Audit rules not added by Wazuh","user":{"login":"bah07","id":6572618,"node_id":"MDQ6VXNlcjY1NzI2MTg=","avatar_url":"https://avatars2.githubusercontent.com/u/6572618?v=4","gravatar_id":"","url":"https://api.github.com/users/bah07","html_url":"https://github.com/bah07","followers_url":"https://api.github.com/users/bah07/followers","following_url":"https://api.github.com/users/bah07/following{/other_user}","gists_url":"https://api.github.com/users/bah07/gists{/gist_id}","starred_url":"https://api.github.com/users/bah07/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bah07/subscriptions","organizations_url":"https://api.github.com/users/bah07/orgs","repos_url":"https://api.github.com/users/bah07/repos","events_url":"https://api.github.com/users/bah07/events{/privacy}","received_events_url":"https://api.github.com/users/bah07/received_events","type":"User","site_admin":false},"labels":[{"id":246680124,"node_id":"MDU6TGFiZWwyNDY2ODAxMjQ=","url":"https://api.github.com/repos/wazuh/wazuh/labels/bug","name":"bug","color":"d93f0b","default":true},{"id":907878541,"node_id":"MDU6TGFiZWw5MDc4Nzg1NDE=","url":"https://api.github.com/repos/wazuh/wazuh/labels/fim","name":"fim","color":"bfd4f2","default":false}],"state":"closed","locked":false,"assignee":{"login":"bah07","id":6572618,"node_id":"MDQ6VXNlcjY1NzI2MTg=","avatar_url":"https://avatars2.githubusercontent.com/u/6572618?v=4","gravatar_id":"","url":"https://api.github.com/users/bah07","html_url":"https://github.com/bah07","followers_url":"https://api.github.com/users/bah07/followers","following_url":"https://api.github.com/users/bah07/following{/other_user}","gists_url":"https://api.github.com/users/bah07/gists{/gist_id}","starred_url":"https://api.github.com/users/bah07/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bah07/subscriptions","organizations_url":"https://api.github.com/users/bah07/orgs","repos_url":"https://api.github.com/users/bah07/repos","events_url":"https://api.github.com/users/bah07/events{/privacy}","received_events_url":"https://api.github.com/users/bah07/received_events","type":"User","site_admin":false},"assignees":[{"login":"bah07","id":6572618,"node_id":"MDQ6VXNlcjY1NzI2MTg=","avatar_url":"https://avatars2.githubusercontent.com/u/6572618?v=4","gravatar_id":"","url":"https://api.github.com/users/bah07","html_url":"https://github.com/bah07","followers_url":"https://api.github.com/users/bah07/followers","following_url":"https://api.github.com/users/bah07/following{/other_user}","gists_url":"https://api.github.com/users/bah07/gists{/gist_id}","starred_url":"https://api.github.com/users/bah07/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bah07/subscriptions","organizations_url":"https://api.github.com/users/bah07/orgs","repos_url":"https://api.github.com/users/bah07/repos","events_url":"https://api.github.com/users/bah07/events{/privacy}","received_events_url":"https://api.github.com/users/bah07/received_events","type":"User","site_admin":false}],"milestone":null,"comments":1,"created_at":"2018-10-29T11:17:54Z","updated_at":"2018-11-12T09:53:50Z","closed_at":"2018-11-12T09:53:50Z","author_association":"MEMBER","body":"When a directory is configured with _WHODATA_ to be monitored in FIM audit rules are created with the key `wazuh_fim`. If another program or a user manually adds a rule to the same directory, Audit does not overwrite the rule but instead uses the same rule it generated before and applies its corresponding key. \r\nWhen FIM receives the audit events, it filters by means of the key with which it has created its rules to discard the events that do not interest it, this causes that the events generated by rules that are not overwritten and that have a different key are discarded."},"comment":{"url":"https://api.github.com/repos/wazuh/wazuh/issues/comments/437820161","html_url":"https://github.com/wazuh/wazuh/issues/1752#issuecomment-437820161","issue_url":"https://api.github.com/repos/wazuh/wazuh/issues/1752","id":437820161,"node_id":"MDEyOklzc3VlQ29tbWVudDQzNzgyMDE2MQ==","user":{"login":"vikman90","id":10536251,"node_id":"MDQ6VXNlcjEwNTM2MjUx","avatar_url":"https://avatars3.githubusercontent.com/u/10536251?v=4","gravatar_id":"","url":"https://api.github.com/users/vikman90","html_url":"https://github.com/vikman90","followers_url":"https://api.github.com/users/vikman90/followers","following_url":"https://api.github.com/users/vikman90/following{/other_user}","gists_url":"https://api.github.com/users/vikman90/gists{/gist_id}","starred_url":"https://api.github.com/users/vikman90/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vikman90/subscriptions","organizations_url":"https://api.github.com/users/vikman90/orgs","repos_url":"https://api.github.com/users/vikman90/repos","events_url":"https://api.github.com/users/vikman90/events{/privacy}","received_events_url":"https://api.github.com/users/vikman90/received_events","type":"User","site_admin":false},"created_at":"2018-11-12T09:53:50Z","updated_at":"2018-11-12T09:53:50Z","author_association":"MEMBER","body":"Related issue: #1613."}}
{"actor":{"display_login":"vikman90"}}