The same happens to me.

Yes, I was thinking it was the case but why do it all the time?

I use a plugin called Hummingbird by WPMUDEV.

Like many other plugins, HB simply stores it’s data in an internal post type to avoid creating extra db tables (a best practice). Any audit plugin could pick those changes up as post updates, if they don’t configure them to ignore that post type or internal post types.

It seems like your plugin could avoid creating unnecessary audit logs by skipping internal post types by default.
$args = array(
‘labels’ => $labels,
‘description’ => ‘WPHB Minify Groups (internal use)’,
‘public’ => false,
‘publicly_queryable’ => false,
‘show_ui’ => false,
‘show_in_menu’ => false,
‘query_var’ => false,
‘rewrite’ => false,
‘capability_type’ => ‘post’,
‘has_archive’ => false,
‘hierarchical’ => false,
‘supports’ => array()
);

Thank you very much for your answers. I will disable that in my Sucuri alerts.

@evahost

I’m Ignacio, Hummingbird developer. I would like to know more details about your response as I don’t fully understand it.

“skipping those internal post types could leave a security hole for database entries to be created with that post type in order to evade the Sucuri notifications.”

Why could it leave a security hole?

It is just an internal post type that is not public at all.

Thanks