File integrity monitoring observes critical system files and directories, detects unauthorized or unexpected modifications, and reports the changes for investigation. section 9.5 section 8.2
Used during incident analysis, it helps identify potential compromise and prioritize response efforts. Wazuh provides FIM capabilities and can surface results through integrated security and visualization tooling. section 9.5 section 3.5.1
Unexpected change alert
A modification to a critical system file or directory is detected and reported, giving administrators an indicator to investigate during incident response. section 8.2 section 9.5
