examples/03_fim_change.json

{
  "timestamp": "2026-06-06T09:03:11.880+0000",
  "rule": {
    "level": 7,
    "description": "Integrity checksum changed.",
    "id": "550",
    "groups": ["ossec", "syscheck", "pci_dss_11.5"],
    "mitre": {"id": ["T1565"], "tactic": ["Impact"], "technique": ["Data Manipulation"]}
  },
  "agent": {"id": "002", "name": "web-app-prod"},
  "data": {},
  "syscheck": {"path": "/var/www/html/wp-config.php", "size_after": "3120", "mode": "scheduled"},
  "full_log": "File '/var/www/html/wp-config.php' modified\nMode: scheduled\nChanged attributes: size,md5,sha1"
}