Test Custom FIM rules

[Calebasah]

[Vitalisn4]

• I triggered this rule level 100200 with rule id 12 by adding a file on the sytem32 path and could visualize the alert on the dashboard but when I tried to change the id to let;s 8, I saw no alert and have tried to research on why that is happening but have not really find a definite solution.

• Also when I do other test, it shows on the dashboard that the file modification have taken but when i check the rule id, I see 5 and another rule level which is not what I am expecting

[Vitalisn4]

• I potentially did a file change in startup directory and the alert on the image was seen on the dashboard

[Vitalisn4]

• When I went further to test more rules, I kept seeing the default rule level of 5 on the dashboard alongside different rule ids that are default and not what I intended to see and still have not be able to actually cite out the problem

[Vitalisn4]

• same thing here, the test did not go as expected

[Vitalisn4]

• This rule also was trigger as expected but others keep falling to the default wazuh custom rules when I do a test

[Vitalisn4]

• Was able to trigger this rule after I adjusted the parent rule from 60009 which deal with informational events to 62100 which was concerning the windows defender