A security and risk team requires a weekly report to detect VM file system changes and validate the integrity of the OS. Which of the following is the BEST solution for this requirement?

A FIM agent with syslog forwarding provides integrity-monitoring data at the agent level, but without a centralized reporting mechanism the security team cannot easily produce the structured weekly reports required.

Enabling detailed OS-level logging on the VM and forwarding those logs to a central platform allows a security team to collect and retain file system event data outside the VM itself, which is essential for detecting changes and validating OS integrity over time. Centralizing the logs in a SIEM or log management tool supports automated weekly report generation and ensures log data cannot be tampered with even if the VM is compromised.

An antivirus agent is designed to detect and block malware, not to perform file system change detection or OS integrity validation for compliance reporting.

A FIM agent reporting through the local web GUI provides integrity data only within the VM management console and typically lacks the scheduling or historical aggregation features needed to generate regular weekly reports.