I am at a loss as to figure out which ossec.conf file I am to use to configure syscheck to monitor specific files. For example: if on one (or more) agents there is a directory "/opt/ appfiles" that I need to monitor, do I specify this in the servers's config file, or the agents'? or both?
Does the same hold true for Windows? I apologize for what is seemingly a simple question, but I can't find the answer anywhere else. Thank you for any help, Patrick
