Monitor Digital Certificates with Wazuh FIM (ISO 27001 and ENS)

To monitor digital certificates with Wazuh FIM, configure the syscheck module to watch the paths where .pfx, .p12 and .cer files are stored. Any modification or deletion triggers an immediate alert and meets ISO 27001 A.8.24 and ENS mp.com.3.

How do you detect changes to digital certificates with Wazuh FIM?

In this hands-on lab we modify and delete a certificate on Windows to see how FIM (File Integrity Monitoring) detects the changes and what information it surfaces in the Wazuh dashboard.

Why is monitoring certificates mandatory under ISO 27001 and ENS?

ISO 27001 - Control A.8.24

Cryptographic certificates must be protected, controlled and audited. Any change to them must be logged.

ENS - Measure mp.com.3

Protection of authenticity and integrity: cryptographic mechanisms must be protected against unauthorized modification.

In practice: If an auditor asks whether you control who can touch your certificates and whether you keep a record of any modification, the answer has to be yes. This lab is exactly that demonstration.

How do you configure syscheck on the Windows agent?

Edit the ossec.conf file of the Windows agent:

<syscheck>

  <frequency>300</frequency>
  <scan_on_start>yes</scan_on_start>

  <!-- Monitoring of the corporate certificate -->
  <directories realtime="yes"
               check_all="yes"
               report_changes="yes">C:\Users\Administrador\Documents\Certificados\CertificadoEmpresa.pfx</directories>

  <!-- Windows certificate store -->
  <windows_registry>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates</windows_registry>
  <windows_registry>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography</windows_registry>

</syscheck>

Explanation:

realtime="yes": Detects changes instantly
check_all="yes": Verifies hash, permissions, owner and size
report_changes="yes": Enables VirusTotal analysis if integrated
windows_registry: Watches the system certificate store

Restart the agent service on Windows:

Restart-Service WazuhSvc

How do you write a custom rule for critical certificates?

On the Wazuh server, edit the local rules file:

nano /var/ossec/etc/rules/local_rules.xml

Add this rule:

<group name="syscheck,certificate_monitor,">

  <rule id="100200" level="13">
    <if_sid>553</if_sid>
    <field name="syscheck.path">\.pfx$|\.p12$|\.cer$|\.key$</field>
    <description>CRITICO: Certificado digital eliminado - $(syscheck.path)</description>
    <mitre>
      <id>T1485</id>
    </mitre>
    <group>certificate,integrity,gdpr_II_5.1.f,hipaa_164.312.c.1,pci_dss_11.5,</group>
  </rule>

</group>

Explanation:

if_sid 553: Triggers when FIM detects a deleted file
level="13": Critical level (highest priority)
syscheck.path: Filters on certificate extensions (.pfx, .p12, .cer, .key)
MITRE T1485: Data Destruction
group: Compliance tags for GDPR, HIPAA and PCI-DSS

Restart the manager:

systemctl restart wazuh-manager

What information does the FIM dashboard provide?

When a certificate is modified or deleted, the Endpoint Security → File Integrity Monitoring dashboard shows:

Event: added, modified or deleted
Full path of the affected file
SHA256 hash before and after (if modified)
User who performed the action
Exact timestamp
Permission changes, if any

Compliance summary

Regulation	Control	Coverage
ISO 27001	A.8.24	Management of cryptographic certificates
ENS	mp.com.3	Protection of authenticity and integrity
PCI-DSS	11.5	Integrity monitoring
GDPR	Art. 5.1.f	Integrity and confidentiality

How does the certificate alert reach the response team?

The level 13 rule fires the moment FIM detects that a .pfx, .p12, .cer or .key file has been removed. Because Wazuh emails every alert at level 7 and above by default, a critical level 13 event is delivered immediately to the security mailbox, and the MITRE tag T1485 lets your threat-hunting queries group it with other data-destruction activity. With realtime="yes" the notification typically arrives within seconds of the deletion, and the periodic 300-second baseline scan acts as a safety net in case a real-time event is ever missed. That combination is what turns "we think our certificates are protected" into auditable proof.

Next steps

A full Wazuh deployment also covers dashboards like Configuration Assessment, Malware Detection and Threat Hunting. Discover our Wazuh services.

Frequently Asked Questions

What is FIM in Wazuh and how does it protect certificates?

FIM (File Integrity Monitoring) is the syscheck module. It computes a SHA256 hash and records the permissions, owner and size of each watched file, then alerts whenever any of those change or the file is deleted, which lets you protect .pfx, .p12, .cer and .key certificates.

How do I enable real-time certificate monitoring on Windows?

In the Windows agent ossec.conf, add a <directories> entry with realtime="yes", check_all="yes" and report_changes="yes" pointing at the certificate path, then restart the agent with Restart-Service WazuhSvc. With scan_on_start and a 300-second frequency you also get periodic baseline scans.

Why does the certificate deletion rule use level 13?

Level 13 is one of the highest severities in Wazuh's 0-15 scale, reserved for critical events. Deleting a cryptographic certificate can break authentication or signing and maps to MITRE ATT&CK technique T1485 (Data Destruction), so it warrants the highest-priority alert.

Which compliance frameworks does this setup cover?

Monitoring certificate integrity covers ISO 27001 A.8.24, ENS mp.com.3, PCI-DSS 11.5 and GDPR Article 5.1.f. The custom rule also carries compliance group tags for GDPR, HIPAA 164.312.c.1 and PCI-DSS so the evidence is labelled automatically.

What information does the FIM dashboard show after a change?

The Endpoint Security to File Integrity Monitoring dashboard shows the event type (added, modified or deleted), the full file path, the SHA256 hash before and after, the user who acted, the exact timestamp and any permission changes.