Wazuh FIM "not detecting" a changed file usually means it has not looked yet
You add a directory to Wazuh file integrity monitoring, change a file, and nothing happens. On Wazuh 4.14.7 the usual reason is the schedule, not a bug. We measured it on a manager container. The block in the 4.14.7 manager image's default ossec.conf: 43200 yes yes /etc,/usr/bin,/usr/sbin /bin,/sbin,/boot 43200 seconds is 12 hours. No directory has realtime or whodata.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)
Log in to join the discussion and vote.
Log in