The Events tab is the triage queue. Each time a check finds a file that was added, removed or modified against the baseline, it records an event here for a human to review.
¶ Concept
An event carries the path, the change type (added / removed / changed), the exact attributes that differ (permissions, owner, size, hashes…), a severity derived from what changed, and a status:
- New — detected, not yet reviewed.
- Approved — an operator confirms this change is expected/legitimate.
- Suspect — an operator flags this change as unexplained; it must be investigated and it blocks the baseline update.
- Resolved — closed out once the baseline is updated to absorb an approved change.
Severity is assigned from the target: changes to system binaries or account files are critical; SSH keys, certificates and service configs are high; general config is medium; volatile files are info.
¶ How to use it
- Filter by status and severity to focus on what matters (start with critical/high, new).
- Open an event to see the full attribute diff (what exactly changed).
- Approve a change you recognize (a package update, a config you made).
- Flag suspect anything you cannot explain — this raises it to the SIEM and prevents the baseline from silently absorbing it.
- Bulk actions let you approve/flag several events at once after an expected maintenance window.
Golden rule: no change stays un-triaged.
An empty queue means "the box is exactly as trusted"; a non-empty queue is work for the security team.