diff --git a/README.md b/README.md
index 6931319..a7d6e08 100644
--- a/README.md
+++ b/README.md
@@ -2,6 +2,42 @@
 
 Self-hosted Wazuh all-in-one deployment (Manager + Indexer + Dashboard) running on a Proxmox VM converted from the official Wazuh Amazon Machine Image (AMI) OVA.
 
+# Important File Paths
+| Wazuh Manager or Agent | Important File Paths | Description |
+|------------------------|----------------------|-------------|
+| Manager | `/var/ossec/etc/ossec.conf` | Main server config (remoted, vulnerability detector, integrations, active response) |
+| Manager | `/var/ossec/etc/rules/local_rules.xml` | Custom/override rules |
+| Manager | `/var/ossec/etc/decoders/local_decoder.xml` | Custom decoders |
+| Manager | `/var/ossec/etc/lists/` | CDB lists for lookups |
+| Manager | `/var/ossec/etc/shared/default/agent.conf` | Centralized config pushed to agents in the default group |
+| Manager | `/var/ossec/etc/client.keys` | Agent registration keys |
+| Manager | `/var/ossec/logs/ossec.log` | Main manager log |
+| Manager | `/var/ossec/logs/alerts/alerts.json` | Fired alerts (JSON) |
+| Manager | `/var/ossec/logs/alerts/alerts.log` | Fired alerts (plain text) |
+| Manager | `/var/ossec/logs/archives/archives.json` | All events regardless of alert status (if `<logall_json>` enabled) |
+| Manager | `/var/ossec/queue/sockets/` | Internal daemon communication sockets |
+| Manager | `/var/ossec/queue/agents-timestamp` | Agent last-seen timestamps |
+| Manager | `/var/ossec/stats/` | Hourly/weekly statistics |
+| Manager | `/var/ossec/ruleset/rules/` | Stock rule files (override in `local_rules.xml`, don't edit directly) |
+| Manager | `/var/ossec/ruleset/decoders/` | Stock decoders (override in `local_decoder.xml`, don't edit directly) |
+| Manager | `/var/ossec/var/db/global.db` | SQLite agent database |
+| Manager | `/var/ossec/wodles/` | Built-in wodle binaries (SCA, syscollector, etc.) |
+| Agent (Linux) | `/var/ossec/etc/ossec.conf` | Agent config (server address, enrollment, syscheck, log collection, SCA) |
+| Agent (Linux) | `/var/ossec/etc/client.keys` | This agent's registration key |
+| Agent (Linux) | `/var/ossec/etc/shared/` | Configs pushed from the manager |
+| Agent (Linux) | `/var/ossec/logs/ossec.log` | Main agent log |
+| Agent (Linux) | `/var/ossec/queue/sockets/` | Internal sockets |
+| Agent (Linux) | `/var/ossec/var/run/` | PID files |
+| Agent (Linux) | `/var/ossec/ruleset/sca/` | SCA policy files (CIS benchmarks, etc.) |
+| Agent (Linux) | `/var/ossec/tmp/` | Working directory for active response scripts, downloads |
+| Agent (Windows) | `C:\Program Files (x86)\ossec-agent\ossec.conf` | Agent config (lives at install root, no `etc\` subfolder) |
+| Agent (Windows) | `C:\Program Files (x86)\ossec-agent\client.keys` | This agent's registration key |
+| Agent (Windows) | `C:\Program Files (x86)\ossec-agent\shared\` | Pushed group configs |
+| Agent (Windows) | `C:\Program Files (x86)\ossec-agent\active-response\bin\` | Active response scripts |
+| Agent (Windows) | `C:\Program Files (x86)\ossec-agent\ossec.log` | Main agent log |
+
+
+
 ## **From the Proxmox host, download the official Wazuh AMI ova file.**
 ### 1. Download the official AMI. (Version 4.14.5 at time of this commit. Edit as required)
 `wget https://packages.wazuh.com/4.x/vm/wazuh-4.14.5.ova`