Skip to main content

Configuration

A FIM configuration defines what to watch- which files, configuration files, or registry keys, on which endpoints. Changes to those targets then show up on the Events feed.

How to get here​

You need View FIM permission (ZiroXpose edition); creating/editing needs the matching FIM permissions.

  1. Open FIM (see Events), then click the Configuration tab.

Navigate to: FIM → Configuration

URL path: /fim/configuration

The Configuration screen​

The FIM Configuration listThe FIM Configuration list
ColumnWhat it shows
NameThe configuration's name (links to it).
DescriptionWhat it watches.
StatusAn on/off toggle- enable/disable monitoring.
Created ByWho created it.
Created AtWhen.
ActionsEdit and Delete (permission-gated).

Create adds a configuration; View Events jumps to the Events feed.

How do I create a configuration?​

  1. Click Create. The configuration form opens.

    The Create FIM Configuration formThe Create FIM Configuration form

  2. Fill in the fields (red asterisk = required):

    FieldRequiredNotes
    NameYesThe configuration's name.
    Status-On/off; defaults to on.
    Scope-Which endpoints (departments / locations / assets) it applies to.
    DescriptionYesWhat it monitors.
    CategoryYesA label for grouping the watched target.
    Configuration TypeYesFiles, Configuration File, or Registry.
    Include PathsYesPaths/keys to watch (a list for Files/Registry; a single path for Configuration File).
    Exclude Paths-Paths to ignore (Files / Registry only).

  3. Save. EndpointOps starts watching; changes appear on the Events tab.

Paths and patterns​

How you fill Include Paths (and Exclude Paths) depends on the Configuration Type:

  • Files- a list of filesystem paths, one per line. Watch folders or files:
    • Windows: C:\Program Files\MyApp\ or C:\Windows\System32\drivers\etc\hosts
    • Linux / macOS: /etc/ or /etc/ssh/sshd_config
  • Registry- a list of registry key paths, one per line, starting with a hive:
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • HKEY_CURRENT_USER\Software\...
    • (Hive short forms like HKLM\... / HKCU\... are also understood.)
  • Configuration File- a single file path (the file whose versions you compare on the Events tab), e.g. C:\inetpub\wwwroot\web.config.

Exclude Paths uses the same format and is available for Files and Registry

  • list anything inside an included path that you don't want to watch.

Glob patterns​

Both Files and Registry include/exclude paths support glob wildcards, so one line can match many paths:

PatternMatches
*Any characters within a single segment (not across \ or /).
**Any depth of sub-folders/keys (recursive).
?A single character.

Examples:

  • C:\Logs\*.log- every .log file directly in C:\Logs.
  • C:\inetpub\**\web.config- every web.config under C:\inetpub, at any depth.
  • /etc/**/*.conf- every .conf file anywhere under /etc.
  • HKEY_LOCAL_MACHINE\SOFTWARE\**\Run- every Run key under SOFTWARE.

Use Exclude Paths with the same globs to carve out noisy sub-paths (for example, include C:\App\** but exclude C:\App\cache\**).

Tips & troubleshooting​

  • No events from a configuration. Confirm Status is on, the Scope includes the right machines, and the Include Paths match what's actually on disk; then Scan Endpoints from the Events tab.
  • Events- the change feed your configurations produce.