Wazuh: the syscheck event is the change type

The word is the reported change

A file-integrity alert can set a syscheck event field to added, modified, or deleted. That word is what the agent reported happened to the path. Added means the agent reported a new path. Modified means it reported a change. Deleted means it reported the path gone.

The word is not a judgment that the file is unwanted. A modified lab config can be a planned edit.

The path is required with the word

The change type without the path does not say which file. The path without the change type does not say what the agent reported. File them together.

If the event field is absent, write “change type not on this alert.” Do not assume modified because a hash is present.

What to file

File the agent id, the path, and the change type. A sentence about the file uses those three. Do not add a verdict the alert does not contain.

Worked case: modified read as unwanted

Agent 014 reports syscheck event modified for path /etc/lab/app.conf. A draft says the file is unwanted because it changed. No other field on the alert says that.

The note quotes modified and the path. The change type is the agent’s report of a modification. Unwanted is not in the alert. The draft’s verdict is removed.

Snippet

agent.id: 014
path: /etc/lab/app.conf
syscheck event: modified
write: the agent reported a modification of that path
not: the file is unwanted

Diagram

The change word is a report

Pair it with the path. Do not add a verdict.

added
The agent reported a path it had not stored before.
modified
The agent reported a change to a path it already stored.
deleted
The agent reported that path gone.
Absent
Say the change type was not on the alert.

Check yourself

1. syscheck event is modified for /etc/lab/app.conf. What does modified mean?

2. The alert has a path and no change type. What do you write?

3. Why keep the path next to the change type?