Tech
Wazuh FIM "not detecting" a changed file usually means it has not looked yet
You add a directory to Wazuh file integrity monitoring, change a file, and nothing happens. On Wazuh 4.14.7 the usual reason is the schedule, not a bug. We measured it on a manager container.
The defaults
The <syscheck> block in the 4.14.7 manager image's default ossec.conf :
<frequency> 43200 </frequency>
<scan_on_start> yes </scan_on_start>
<alert_new_files> yes </alert_new_files>
<directories> /etc,/usr/bin,/usr...
Read the full discussion on Dev.to
This article was aggregated from Dev.to. Click to join the conversation.
View on Dev.to