I'm not sure I've ever noticed this but how does ossec alert or notify if an entire directory has been deleted or does it? If I'm monitoring / etc/test/drivers for example and someone deletes the entire /drivers directory will there be a notification similar to file changes?
Thanks!
