Wazuh FIM "not detecting" a changed file usually means it has not looked yet

When you add a directory to Wazuh file integrity monitoring and then change a file within it, the system typically waits for the next scheduled scan before reporting the change. On Wazuh 4.14.7, the default scan frequency is 12 hours. This delay occurs because the system only records a baseline during the initial scan. If a file is altered after the first scan, it will only be detected in the subsequent scheduled scan, provided 12 hours have passed.

Testing confirmed that a file change detected within seconds of the initial scan in a plain directory, but not in a directory with real-time monitoring due to the 12-hour interval. To adjust the monitoring, increase the frequency for specific paths to real-time, which allows for immediate detection of file changes. Simply modifying the configuration in the agent.conf file to include "syscheck directories realtime= yes" in the desired directories will enable real-time monitoring.

However, real-time monitoring should be applied sparingly to avoid generating excessive alerts, particularly on large or frequently changing directories.