Atomicorp

Hello, I am trying to use OSSEC primarily as a syscheck tool for agentless devices.
All of the rules seemingly work (addition of file, modification, etc) but it seems that file deletion is not detected in alerts.
How do I enable this feature? is it enabled by default on installation similar to how other rules were? (new file, modification).
I do not use realtime as I am trying to create a fully agentless environment.

Hello!

Please see this doc for agentless configuration https://docs.atomicorp.com/AEO/agentles ... =agentless
You will probably want to change the conf for <state>periodic</state> to <state>periodic_diff</state>