The server got hit and I only knew because a file quietly changed itself

File integrity monitoring is the security control nobody gets excited about — until it's the only thing that catches the compromise. Here's the Wazuh setup I run.