33. File integrity monitoring (FIM)

FIM watches chosen files, directories and (on Windows) registry keys on each host. The agent records an approved baseline - hashes, sizes, owners, permissions - and then reports every change against it, with the process that made the change when the platform can identify it. A change is either expected (a patch, a deployment) and accepted into the baseline, or unauthorised and investigated.

FIM is a licensed module.

Permissions:

33.1 The tabs#

Path: FIM. The page title is File integrity monitoring.

• Tiles: Total events, Critical/High, Investigating, Malicious.
• Tabs: Changes, Policies, Agents and baselines.

33.2 Procedure: create a FIM policy#

Permission: Manage FIM. Four-eyes: no.

Risk: watching a busy directory (logs, caches, temporary files) floods the event list and costs CPU on the host. Rollback: disable or delete the policy.

1. Open FIM > Policies and press New policy.
2. Optional: Start from a template - "fills the fields below; everything stays editable". Or keep Blank policy.
3. Fill the form:

4. Press Create policy (or Save changes for an existing policy). The button stays disabled while "N problems to fix before saving" is shown; each problem is named under its field.

What you see: the policy in Policies with its Scope, Watches, Filters and Reports.

Next: build the baseline on each agent (33.3). Until a baseline exists the agent has nothing to compare against.

Procedure: change, disable or delete a FIM policy#

Permission: Manage FIM. Four-eyes: no. Risk: disabling or deleting a policy stops monitoring those paths on its hosts, so changes there go unseen; widening it can flood the event list. Rollback: change it back, enable it again, or create it again (a deleted policy is gone, with its baselines).

To change it:

1. Open FIM > Policies and click the policy's name. The editor opens with its values.
2. Change the fields and press Save changes. Agents pick up the change within five minutes. Build the baseline again (33.3) if you changed the paths or filters.

To disable or enable it:

1. Press Disable on the policy's row. The row shows " - disabled" under the name and its hosts stop monitoring those paths; Verify all agents is greyed out.
2. Press Enable to turn it back on. You see "Policy enabled".

To delete it:

1. Press Delete on the policy's row.
2. Confirm "Delete policy "<name>"? Its hosts stop monitoring these paths."
3. What you see: "Policy deleted". Events it already raised stay in Changes.

33.3 Baselines and verification#

Path: FIM > Agents and baselines. Columns: Agent, Policy, Mode, Baseline, Last baseline, Last verify. "No policy applies to this host." means no policy targets it.

Procedure: build a baseline#

Do this after the host is in its approved state (after patching, before go-live).

1. Find the agent and policy row and press Baseline now.
2. The scan view opens: "Waiting for the agent. Tasks are delivered on its next heartbeat and run on the host."
3. When it completes, the Baseline column shows the number of entries. Click it to browse the baseline (Path, Type, Mode, Owner, Size, Hash; Filter by path...).

Procedure: verify a host against its baseline#

1. Press Verify now on the row (or Verify all agents on the Policies tab, which says "N scan(s) queued" and how many hosts were skipped).
2. The agent re-hashes the policy's files and reports every difference as an event.
3. Open the result from the Last verify cell of the row. "No differences: all N path(s) match the baseline." means nothing changed.

Procedure: accept verified changes into the baseline#

Permission: Manage FIM. Use this after a planned change (patching, a deployment), once you have confirmed every difference is legitimate. Rollback: none in the console; if you accepted a change by mistake, restore the file on the host and build the baseline again.

1. Open the verification result (step 3 above). It lists each changed, new and removed path.
2. Press Accept on a single path, or Accept all N change(s) into the baseline.
3. The baseline now holds the new state; the next verification compares against it.

Administrators can also run both from Operations (chapter 39).

33.4 Working the changes#

Path: FIM > Changes. The Event matrix: File path, Host, Event type, Changed by, Severity, Status, Risk, Detected. Filter by path... narrows it.

Click an event for the detail: Path, Change, Severity, Risk, Host, Authorised, Detected, Changed by (process, Identified by, Executable), Renamed from, Found by, and the before/after of Mode, Size, Owner and the hashes (Hash before, Hash after).

Procedure: triage a change#

Permission: Triage findings.

1. Open the event and press one of the statuses under Set status:

2. Type the reason in the note and press Save.

Procedure: accept a change into the baseline#

Permission: Manage FIM. Use this only for a change you have confirmed is legitimate.

1. Open the event and press Accept into baseline.
2. The baseline is updated to the file's new state, so later verifications compare against it.

A malicious change: open an investigation (chapter 34) and consider containment (chapter 36). Do not accept it into the baseline.

33.5 If it fails#