This is the documentation for Wazuh 3.9. Check out the docs for the latest version of Wazuh!

Auditing who-data

New in version 3.4.0.

From version 3.4.0, Wazuh incorporates a new functionality which obtains the who-data information from monitored files.

This information contains the user who made the changes on the monitored files and also the program name or process used to carry them out.