Unix Critical File Accessed Detected alert

[sv7]

We have observed more count for Unix Critical File Accessed Detected alert from the user “root” on the Host XYZ-FMC-SECONDARY. And also we observed multiple File names which is containing /etc, due to that alert is triggering. 

Can anyone help me how to resolve this.

[Marvin Rhoads]

What system is showing you this alert? Can you provide a sanitized screen shot?

[sv7]

Please check attach excel file.

[Marvin Rhoads]

Attaching a random spreadsheet does not answer the question "What system is showing you this alert?"

[sv7]

Its ALsec threat management tool that collects fmc logs