How a silent file change alert caught a supply-chain threat on a small business server

A small business infrastructure operator discovered a potential security incident last month after a file integrity monitoring (FIM) system flagged an unauthorized change to a binary inside a running container. No firewall alerts or intrusion detection logs triggered — only the FIM tool, Wazuh, detected that a base image hash had changed without any authorized deployment. Investigation revealed a legitimate supply-chain issue with the container image, which turned out to be harmless, but the incident highlighted FIM's value as a last-resort detection layer. The author runs Wazuh as a Docker stack, tuned to monitor critical paths like binaries and config files, generating a baseline and alerting on unexpected checksum changes. Beyond threat detection, the setup also serves as an audit trail, allowing admins to document exactly which files changed, when, and under whose access.