Host-based anomaly detection event (rootcheck).

[sizzling~snitch]

Hello All, I found that OPNsense had a built-in Wazuh agent so I set it up and right away I am getting an alert:

Host-based anomaly detection event (rootcheck).
- Files hidden inside directory '/boot/efi'. Link count does not match number of files (3,1).

I enabled SSH temporarily and looked at that location as root (sudo su) and not seeing anything hidden. Thinking as this is also a new install (OPNsense 23.10.2-amd64) it might be some kind of false-positive.

Has anyone seen this before in their setup of Wazuh-Agent plugin?

[sizzling~snitch]

Following up on this, turns out this is a false positive and has been documented.

[sylaan]

Where is this documented ?